windows-server-2003/base/fs/rdr2/rdbss/smb.mrx/srvcall.c

/*++ BUILD Version: 0009    // Increment this if a change has global effects
Copyright (c) 1987-1993  Microsoft Corporation

Module Name:

    srvcall.c

Abstract:

    This module implements the routines for handling the creation/manipulation of
    server entries in the connection engine database. It also contains the routines
    for parsing the negotiate response from  the server.

Author:

    Balan Sethu Raman (SethuR) 06-Mar-95    Created

--*/

#include "precomp.h"
#pragma hdrstop

#ifdef  ALLOC_PRAGMA
#pragma alloc_text(PAGE, SmbCeCreateSrvCall)
#pragma alloc_text(PAGE, MRxSmbCreateSrvCall)
#pragma alloc_text(PAGE, MRxSmbFinalizeSrvCall)
#pragma alloc_text(PAGE, MRxSmbSrvCallWinnerNotify)
#pragma alloc_text(PAGE, MRxSmbInitializeEchoProbeService)
#pragma alloc_text(PAGE, MRxSmbTearDownEchoProbeService)
#pragma alloc_text(PAGE, MRxSmbMaskNegotiateSmb)
#pragma alloc_text(PAGE, BuildNegotiateSmb)
#endif

RXDT_DefineCategory(SRVCALL);
#define Dbg        (DEBUG_TRACE_SRVCALL)

extern BOOLEAN MRxSmbSecuritySignaturesEnabled;
extern BOOLEAN MRxSmbSecuritySignaturesRequired;

VOID
SmbCeCreateSrvCall(
    PMRX_SRVCALL_CALLBACK_CONTEXT  pCallbackContext)
/*++

Routine Description:

   This routine patches the RDBSS created srv call instance with the information required
   by the mini redirector.

Arguments:

    CallBackContext  - the call back context in RDBSS for continuation.

Return Value:

    RXSTATUS - The return status for the operation

--*/
{
    NTSTATUS Status;

    PMRX_SRVCALLDOWN_STRUCTURE SrvCalldownStructure;
    PMRX_SRV_CALL pSrvCall;

    PAGED_CODE();

    SrvCalldownStructure =
        (PMRX_SRVCALLDOWN_STRUCTURE)(pCallbackContext->SrvCalldownStructure);

    pSrvCall = SrvCalldownStructure->SrvCall;

    ASSERT( pSrvCall );
    ASSERT( NodeType(pSrvCall) == RDBSS_NTC_SRVCALL );

    SmbCeInitializeServerEntry(
        pSrvCall,
        pCallbackContext,
        SrvCalldownStructure->RxContext->Create.TreeConnectOpenDeferred);
}


NTSTATUS
MRxSmbCreateSrvCall(
    PMRX_SRV_CALL                  pSrvCall,
    PMRX_SRVCALL_CALLBACK_CONTEXT  pCallbackContext)
/*++

Routine Description:

   This routine patches the RDBSS created srv call instance with the information required
   by the mini redirector.

Arguments:

    RxContext        - Supplies the context of the original create/ioctl

    CallBackContext  - the call back context in RDBSS for continuation.

Return Value:

    RXSTATUS - The return status for the operation

Notes:

    Certain transport related interfaces require handle to be passed in. This
    implies that the SRV_CALL instances need to be initialized in the context
    of a well known process, i.e., the RDBSS process.

    In the normal course of event is this request was issued within the context
    of the system process we should continue without having to post. However
    there are cases in MIPS  when stack overflows. In order to avoid such situations
    the request is posted in all cases.

--*/
{
    NTSTATUS Status;
    UNICODE_STRING ServerName;

    PMRX_SRVCALL_CALLBACK_CONTEXT SCCBC = pCallbackContext;
    PMRX_SRVCALLDOWN_STRUCTURE SrvCalldownStructure = (PMRX_SRVCALLDOWN_STRUCTURE)(pCallbackContext->SrvCalldownStructure);

    PAGED_CODE();

    ASSERT( pSrvCall );
    ASSERT( NodeType(pSrvCall) == RDBSS_NTC_SRVCALL );

    // Dispatch the request to a system thread.
    Status = RxDispatchToWorkerThread(
                 MRxSmbDeviceObject,
                 DelayedWorkQueue,
                 SmbCeCreateSrvCall,
                 pCallbackContext);

    if (Status == STATUS_SUCCESS) {
        // Map the return value since the wrapper expects PENDING.
        Status = STATUS_PENDING;
    } else {
        // There was an error in dispatching the SmbCeCreateSrvCall method to
        // a worker thread. Complete the request and return STATUS_PENDING.

        SCCBC->Status = Status;
        SrvCalldownStructure->CallBack(SCCBC);
        Status = STATUS_PENDING;
    }

    return Status;
}

NTSTATUS
MRxSmbFinalizeSrvCall(
    PMRX_SRV_CALL pSrvCall,
    BOOLEAN       Force)
/*++

Routine Description:

   This routine destroys a given server call instance

Arguments:

    pSrvCall  - the server call instance to be disconnected.

    Force     - TRUE if a disconnection is to be enforced immediately.

Return Value:

    RXSTATUS - The return status for the operation

--*/
{
    NTSTATUS              Status = STATUS_SUCCESS;
    PSMBCEDB_SERVER_ENTRY pServerEntry;

    PAGED_CODE();

    // if the server entry is not filled in, then there's nothing to do. this occurs
    // on a srvcall that we never successfuly hooked up to........
    if (pSrvCall->Context == NULL) {
        return(Status);
    }


    pServerEntry = SmbCeGetAssociatedServerEntry(pSrvCall);

    if (pServerEntry != NULL) {
        InterlockedCompareExchangePointer(
            &pServerEntry->pRdbssSrvCall,
            NULL,
            pSrvCall);
        SmbCeDereferenceServerEntry(pServerEntry);
    }

    pSrvCall->Context = NULL;

    return Status;
}

NTSTATUS
MRxSmbSrvCallWinnerNotify(
    IN PMRX_SRV_CALL  pSrvCall,
    IN BOOLEAN        ThisMinirdrIsTheWinner,
    IN OUT PVOID      pSrvCallContext)
/*++

Routine Description:

   This routine finalizes the mini rdr context associated with an RDBSS Server call instance

Arguments:

    pSrvCall               - the Server Call

    ThisMinirdrIsTheWinner - TRUE if this mini rdr is the choosen one.

    pSrvCallContext  - the server call context created by the mini redirector.

Return Value:

    RXSTATUS - The return status for the operation

Notes:

    The two phase construction protocol for Server calls is required because of parallel
    initiation of a number of mini redirectors. The RDBSS finalizes the particular mini
    redirector to be used in communicating with a given server based on quality of
    service criterion.

--*/
{
    NTSTATUS Status = RX_MAP_STATUS(SUCCESS);
    PSMBCEDB_SERVER_ENTRY pServerEntry;

    PAGED_CODE();

    pServerEntry = (PSMBCEDB_SERVER_ENTRY)pSrvCallContext;

    if (!ThisMinirdrIsTheWinner) {

        //
        // Some other mini rdr has been choosen to connect to the server. Destroy
        // the data structures created for this mini redirector.
        //
        SmbCeUpdateServerEntryState(pServerEntry,SMBCEDB_MARKED_FOR_DELETION);
        SmbCeDereferenceServerEntry(pServerEntry);
        return STATUS_SUCCESS;
    }

    pSrvCall->Context  = pServerEntry;

    pSrvCall->Flags   |= SRVCALL_FLAG_CASE_INSENSITIVE_NETROOTS |
                         SRVCALL_FLAG_CASE_INSENSITIVE_FILENAMES;

    pSrvCall->MaximumNumberOfCloseDelayedFiles = MRxSmbConfiguration.DormantFileLimit + 1;

    return STATUS_SUCCESS;
}

extern GUID CachedServerGuid;

NTSTATUS
MRxSmbCheckForLoopBack(
    IN PSMBCEDB_SERVER_ENTRY pServerEntry)
/*++

Routine Description:

   This routine checks for loop back case and set the flag accordingly

Arguments:

    pServerEntry - the Server Entry

Return Value:

    RXSTATUS - The return status for the operation

Notes:

--*/
{
    pServerEntry->Server.IsLoopBack = FALSE;

    //
    // Check for loopback.  NT5 servers support extended security, and return a
    //  GUID in the negotiate response. We also know that the NT5 server stores
    //  its GUID in the registry.  So we compare the registry value on this machine
    //  to the GUID value returned from the server to which we just connected.  If
    //  they match, then we are looping back to ourselves!
    //
    // The Server registry entry is now cached to prevent deadlock.
    //
    if( BooleanFlagOn( pServerEntry->Server.DialectFlags, DF_EXTENDED_SECURITY ) ) {

	if( RtlCompareMemory( &CachedServerGuid,
			      &pServerEntry->Server.NtServer.ServerGuid,
			      sizeof( GUID ) ) == sizeof( GUID ) ) {

	    //
	    // The GUID in the registry (cached) matches the GUID we got back from the
	    //  server!  We must be looping back to ourselves!
	    //
	    pServerEntry->Server.IsLoopBack = TRUE;
	}

    }

    return STATUS_SUCCESS;
}

//
// The following type defines and data structures are used for parsing negotiate SMB
// responses.
//

#include "protocol.h"

//superceded in smbxchng.h
//#define MRXSMB_PROCESS_ID 0xCAFE

typedef enum _SMB_NEGOTIATE_TYPE_ {
    SMB_CORE_NEGOTIATE,
    SMB_EXTENDED_NEGOTIATE,
    SMB_NT_NEGOTIATE
} SMB_NEGOTIATE_TYPE, *PSMB_NEGOTIATE_TYPE;

typedef struct _SMB_DIALECTS_ {
    SMB_NEGOTIATE_TYPE   NegotiateType;
    USHORT               DispatchVectorIndex;
} SMB_DIALECTS, *PSMB_DIALECTS;

SMBCE_SERVER_DISPATCH_VECTOR
s_SmbServerDispatchVectors[] = {
    {BuildSessionSetupSmb,CoreBuildTreeConnectSmb},
    {BuildSessionSetupSmb,LmBuildTreeConnectSmb},
    {BuildSessionSetupSmb,NtBuildTreeConnectSmb},
    {BuildSessionSetupSmb,NtBuildTreeConnectSmb}
    };

//CODE.IMPROVEMENT since, in fact, we may never implement XENIXCORE and MSNET13
// we should hack them out. however, there is an enum in smbce.h that must be kept
// sync with these arrays.

SMB_DIALECTS
s_SmbDialects[] = {
    { SMB_CORE_NEGOTIATE, 0},
    //{ SMB_CORE_NEGOTIATE, 0 },
    //{ SMB_EXTENDED_NEGOTIATE, 1 },
    { SMB_EXTENDED_NEGOTIATE, 1 },
    { SMB_EXTENDED_NEGOTIATE, 1 },
    { SMB_EXTENDED_NEGOTIATE, 1 },
    { SMB_EXTENDED_NEGOTIATE, 1 },
    { SMB_NT_NEGOTIATE, 2 },
    { SMB_NT_NEGOTIATE, 3}
};

CHAR s_DialectNames[] = {
    "\2"  PCNET1 "\0"
    //\2notyet"  XENIXCORE "\0"
    //\2notyet"  MSNET103 "\0"
    "\2"  LANMAN10 "\0"
    "\2"  WFW10 "\0"
    "\2"  LANMAN12 "\0"
    "\2"  LANMAN21
    "\0\2"  NTLANMAN
    };

#define __second(a,b) (b)
ULONG
MRxSmbDialectFlags[] = {
    __second( PCNET1,    DF_CORE ),

    //__second( XENIXCORE, DF_CORE | DF_MIXEDCASEPW | DF_MIXEDCASE ),

    //__second( MSNET103,  DF_CORE | DF_OLDRAWIO | DF_LOCKREAD | DF_EXTENDNEGOT ),

    __second( LANMAN10,  DF_CORE | DF_NEWRAWIO | DF_LOCKREAD | DF_EXTENDNEGOT |
                    DF_LANMAN10 ),

    __second( WFW10,  DF_CORE | DF_NEWRAWIO | DF_LOCKREAD | DF_EXTENDNEGOT |
                    DF_LANMAN10 | DF_WFW),

    __second( LANMAN12,  DF_CORE | DF_NEWRAWIO | DF_LOCKREAD | DF_EXTENDNEGOT |
                    DF_LANMAN10 | DF_LANMAN20 |
                    DF_MIXEDCASE | DF_LONGNAME | DF_SUPPORTEA ),

    __second( LANMAN21,  DF_CORE | DF_NEWRAWIO | DF_LOCKREAD | DF_EXTENDNEGOT |
                    DF_LANMAN10 | DF_LANMAN20 |
                    DF_MIXEDCASE | DF_LONGNAME | DF_SUPPORTEA |
                    DF_LANMAN21),

    __second( NTLANMAN,  DF_CORE | DF_NEWRAWIO |
                    DF_NTPROTOCOL | DF_NTNEGOTIATE |
                    DF_MIXEDCASEPW | DF_LANMAN10 | DF_LANMAN20 |
                    DF_LANMAN21 | DF_MIXEDCASE | DF_LONGNAME |
                    DF_SUPPORTEA | DF_TIME_IS_UTC )
};

ULONG s_NumberOfDialects = sizeof(s_SmbDialects) / sizeof(s_SmbDialects[0]);

PBYTE s_pNegotiateSmb =  NULL;
PBYTE s_pNegotiateSmbRemoteBoot =  NULL;
ULONG s_NegotiateSmbLength = 0;

PBYTE s_pEchoSmb  = NULL;
BYTE  s_EchoData[] = "JlJmIhClBsr";

#define SMB_ECHO_COUNT (1)

// Number of ticks 100ns ticks in a day.
LARGE_INTEGER s_MaxTimeZoneBias;

extern NTSTATUS
GetNTSecurityParameters(
    PSMB_ADMIN_EXCHANGE pSmbAdminExchange,
    PSMBCE_SERVER       pServer,
    PUNICODE_STRING     pDomainName,
    PRESP_NT_NEGOTIATE  pNtNegotiateResponse,
    ULONG               BytesIndicated,
    ULONG               BytesAvailable,
    PULONG              pBytesTaken,
    PMDL                *pDataBufferPointer,
    PULONG              pDataSize);

extern NTSTATUS
GetLanmanSecurityParameters(
    PSMB_ADMIN_EXCHANGE pSmbAdminExchange,
    PSMBCE_SERVER       pServer,
    PRESP_NEGOTIATE     pNegotiateResponse,
    ULONG               BytesIndicated);

extern VOID
GetLanmanTimeBias(
    PSMBCE_SERVER   pServer,
    PRESP_NEGOTIATE pNegotiateResponse);

// Number of 100 ns ticks in one minute
#define ONE_MINUTE_IN_TIME (60 * 1000 * 10000)

NTSTATUS
MRxSmbInitializeEchoProbeService(
    PMRXSMB_ECHO_PROBE_SERVICE_CONTEXT pEchoProbeContext)
/*++

Routine Description:

    This routine builds the echo SMB

Return Value:

    STATUS_SUCCESS if construction of an ECHO smb was successful

    Other Status codes correspond to error situations.

--*/
{
    NTSTATUS    Status = STATUS_SUCCESS;
    ULONG       DialectIndex;

    PSMB_HEADER    pSmbHeader = NULL;
    PREQ_ECHO      pReqEcho   = NULL;

    PAGED_CODE();

    pEchoProbeContext->EchoSmbLength = sizeof(SMB_HEADER) +
                                     FIELD_OFFSET(REQ_ECHO,Buffer) +
                                     sizeof(s_EchoData);

    pEchoProbeContext->pEchoSmb = (PBYTE)RxAllocatePoolWithTag(
                                           NonPagedPool,
                                           pEchoProbeContext->EchoSmbLength,
                                           MRXSMB_ECHO_POOLTAG);

    if (pEchoProbeContext->pEchoSmb != NULL) {
        pSmbHeader = (PSMB_HEADER)pEchoProbeContext->pEchoSmb;
        pReqEcho   = (PREQ_ECHO)((PBYTE)pEchoProbeContext->pEchoSmb + sizeof(SMB_HEADER));

        // Fill in the header
        RtlZeroMemory( pSmbHeader, sizeof( SMB_HEADER ) );

        *(PULONG)(&pSmbHeader->Protocol) = (ULONG)SMB_HEADER_PROTOCOL;

        // By default, paths in SMBs are marked as case insensitive and
        // canonicalized.
        pSmbHeader->Flags =
            SMB_FLAGS_CASE_INSENSITIVE | SMB_FLAGS_CANONICALIZED_PATHS;

        // Get the flags2 field out of the SmbContext
        SmbPutAlignedUshort(
            &pSmbHeader->Flags2,
            (SMB_FLAGS2_KNOWS_LONG_NAMES |
             SMB_FLAGS2_KNOWS_EAS        |
             SMB_FLAGS2_IS_LONG_NAME     |
             SMB_FLAGS2_NT_STATUS        |
             SMB_FLAGS2_UNICODE));

        // Fill in the process id.
        SmbPutUshort(&pSmbHeader->Pid, MRXSMB_PROCESS_ID );
        SmbPutUshort(&pSmbHeader->Tid,0xffff); // Invalid TID

        // Lastly, fill in the smb command code.
        pSmbHeader->Command = (UCHAR) SMB_COM_ECHO;

        pReqEcho->WordCount = 1;

        RtlMoveMemory( pReqEcho->Buffer, s_EchoData, sizeof( s_EchoData ) );

        SmbPutUshort(&pReqEcho->EchoCount, SMB_ECHO_COUNT);
        SmbPutUshort(&pReqEcho->ByteCount, (USHORT) sizeof( s_EchoData ) );
    } else {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    }

    return Status;
}

VOID
MRxSmbTearDownEchoProbeService(
    PMRXSMB_ECHO_PROBE_SERVICE_CONTEXT pEchoProbeContext)
/*++

Routine Description:

    This routine tears down the echo processing context

--*/
{
    PAGED_CODE();

    if (pEchoProbeContext->pEchoSmb != NULL) {
        RxFreePool(pEchoProbeContext->pEchoSmb);
        pEchoProbeContext->pEchoSmb = NULL;
    }
}

ULONG MRxSmbNegotiateMask = 6;  //controls which protocols are not negotiated

//#define MRXSMB_ALLOW_NEGOTIATE_MASKING
#ifdef MRXSMB_ALLOW_NEGOTIATE_MASKING
ULONG MRxSmbCapturedNegotiateMask = 0;  //indicates which protocols are currently defeated
CHAR MRxSmbDefeatString[] = "xyz";

VOID
MRxSmbMaskNegotiateSmb ()
/*++

Routine Description:

    This routine masks the negotiate buffer to reduce the number of dialects that are
    negotiated.

Arguments:

   none

Return Value:

    NA

--*/
{
    PREQ_NEGOTIATE pReqNegotiate;
    PUCHAR p,pshadow,q;
    ULONG i,numberofdialects,negotiatemask;

    PAGED_CODE();

    if ((MRxSmbNegotiateMask == MRxSmbCapturedNegotiateMask)
            || (s_pNegotiateSmb == NULL) ){
        return;
    }

    pReqNegotiate = (PREQ_NEGOTIATE)(s_pNegotiateSmb + sizeof(SMB_HEADER));

    p = pReqNegotiate->Buffer;
    pshadow = s_DialectNames;
    negotiatemask = MRxSmbNegotiateMask;
    numberofdialects = sizeof(MRxSmbDialectFlags)/sizeof(MRxSmbDialectFlags[0]);

    DbgPrint("Build Negotiate mask=%x\n",negotiatemask);

    for (i=0;;) {

        ASSERT(*p == '\2');
        ASSERT(*pshadow == '\2');
        p++; pshadow++;
        DbgPrint("Considering Protocol %s\n",pshadow);
        if (negotiatemask&1) {
            DbgPrint("Protocol to fffff %s\n",pshadow);
        }

        //for each protocol, either copy in characters from the defeat string
        //or from the original source depending on the mask. here, pshadow points
        //to the original, q points to the defeat string and p points to the actual
        //bits in the SMB_COM_NEGOTIATE

        for (q=MRxSmbDefeatString;;) {
            if (*p=='\2') break;
            if (*q==0) break;
            if (negotiatemask&1) {
                *p = *q;
            } else {
                *p = *pshadow;
            }
            p++; q++; pshadow++;
        }

        i++;
        if (i>=numberofdialects) break;

        negotiatemask>>=1;
        //if(negotiate_mask==0)break;

        DbgPrint("moving up to i=%d\n",i);
        for (;*p!='\2';) {
            p++; pshadow++;
        }

    }

    MRxSmbCapturedNegotiateMask = MRxSmbNegotiateMask;

}
#else
#define MRxSmbMaskNegotiateSmb()
#endif

NTSTATUS
BuildNegotiateSmb(
    PVOID    *pSmbBufferPointer,
    PULONG   pSmbBufferLength,
    BOOLEAN  RemoteBootSession)
/*++

Routine Description:

    This routine builds the negotiate SMB

Arguments:

    pSmbBufferPointer    - a placeholder for the smb buffer

    pNegotiateSmbLength  - the smb buffer size

    RemoteBootServer     - is this for connection to a remote boot server

Return Value:

    STATUS_SUCCESS - implies that pServer is a valid instnace .

    Other Status codes correspond to error situations.

--*/
{
    NTSTATUS    Status = STATUS_SUCCESS;
    ULONG       DialectIndex;
    PSMB_HEADER    pSmbHeader    = NULL;
    PREQ_NEGOTIATE pReqNegotiate = NULL;

    PAGED_CODE();

    if (s_pNegotiateSmb == NULL) {
        s_NegotiateSmbLength = sizeof(SMB_HEADER) +
                               FIELD_OFFSET(REQ_NEGOTIATE,Buffer) +
                               sizeof(s_DialectNames);

        s_pNegotiateSmb = (PBYTE)RxAllocatePoolWithTag(
                                     PagedPool,
                                     s_NegotiateSmbLength + TRANSPORT_HEADER_SIZE,
                                     MRXSMB_ADMIN_POOLTAG);

        if (s_pNegotiateSmb != NULL) {

            s_pNegotiateSmb += TRANSPORT_HEADER_SIZE;

            pSmbHeader = (PSMB_HEADER)s_pNegotiateSmb;
            pReqNegotiate = (PREQ_NEGOTIATE)(s_pNegotiateSmb + sizeof(SMB_HEADER));

            // Fill in the header
            RtlZeroMemory( pSmbHeader, sizeof( SMB_HEADER ) );

            *(PULONG)(&pSmbHeader->Protocol) = (ULONG)SMB_HEADER_PROTOCOL;

            // By default, paths in SMBs are marked as case insensitive and
            // canonicalized.
            pSmbHeader->Flags =
                SMB_FLAGS_CASE_INSENSITIVE | SMB_FLAGS_CANONICALIZED_PATHS;

            // Put our flags2 field. The Ox10 is a temporary flag for SLM
            // corruption detection
            SmbPutAlignedUshort(
                &pSmbHeader->Flags2,
                (SMB_FLAGS2_KNOWS_LONG_NAMES
                     | SMB_FLAGS2_KNOWS_EAS
                     | SMB_FLAGS2_IS_LONG_NAME
                     | SMB_FLAGS2_NT_STATUS
                     | SMB_FLAGS2_UNICODE
                     | SMB_FLAGS2_EXTENDED_SECURITY
                     | 0x10
                 ));

            // Fill in the process id.
            SmbPutUshort( &pSmbHeader->Pid, MRXSMB_PROCESS_ID );

            // Lastly, fill in the smb command code.
            pSmbHeader->Command = (UCHAR) SMB_COM_NEGOTIATE;

            pReqNegotiate->WordCount = 0;

            RtlMoveMemory(
                pReqNegotiate->Buffer,
                s_DialectNames,
                sizeof( s_DialectNames ) );

            SmbPutUshort(
                &pReqNegotiate->ByteCount,
                (USHORT) sizeof( s_DialectNames ) );

            // Initialize the maximum time zone bias used in negotiate response parsing.
            s_MaxTimeZoneBias.QuadPart = Int32x32To64(24*60*60,1000*10000);
        } else {
            Status = STATUS_INSUFFICIENT_RESOURCES;
        }
    }

    if (MRxSmbBootedRemotely && s_pNegotiateSmbRemoteBoot == NULL) {
        s_pNegotiateSmbRemoteBoot = (PBYTE)RxAllocatePoolWithTag(
                                             PagedPool,
                                             s_NegotiateSmbLength + TRANSPORT_HEADER_SIZE,
                                             MRXSMB_ADMIN_POOLTAG);

        if (s_pNegotiateSmbRemoteBoot != NULL) {
            USHORT RemoteBootFlags2;

            //
            // Now that s_pNegotiateSmb has been filled in, copy it to
            // s_pNegotiateSmbRemoteBoot and modify as needed. We don't
            // worry about masking s_pNegotiateSmbRemoteBoot.
            //

            s_pNegotiateSmbRemoteBoot += TRANSPORT_HEADER_SIZE;
            RtlCopyMemory(s_pNegotiateSmbRemoteBoot,
                          s_pNegotiateSmb,
                          s_NegotiateSmbLength);

            pSmbHeader = (PSMB_HEADER)s_pNegotiateSmbRemoteBoot;

            //
            // Turn off the SMB_FLAGS2_EXTENDED_SECURITY bit.
            //

            RemoteBootFlags2 = SmbGetAlignedUshort(&pSmbHeader->Flags2);
            RemoteBootFlags2 &= ~SMB_FLAGS2_EXTENDED_SECURITY;
            SmbPutAlignedUshort(&pSmbHeader->Flags2,
                                RemoteBootFlags2);
        } else {
            RxFreePool(s_pNegotiateSmb - TRANSPORT_HEADER_SIZE);
                Status = STATUS_INSUFFICIENT_RESOURCES;
        }
    }

    if (NT_SUCCESS(Status)) {
        *pSmbBufferLength  = s_NegotiateSmbLength;
        if (RemoteBootSession) {
            *pSmbBufferPointer = s_pNegotiateSmbRemoteBoot;
        } else {
            *pSmbBufferPointer = s_pNegotiateSmb;
        }
    }

    MRxSmbMaskNegotiateSmb();

    return Status;
}


ULONG MRxSmbSrvWriteBufSize = 0xffff; //use the negotiated size

NTSTATUS
ParseNegotiateResponse(
    IN OUT PSMB_ADMIN_EXCHANGE pSmbAdminExchange,
    IN     ULONG               BytesIndicated,
    IN     ULONG               BytesAvailable,
       OUT PULONG              pBytesTaken,
    IN     PSMB_HEADER         pSmbHeader,
       OUT PMDL                *pDataBufferPointer,
       OUT PULONG              pDataSize)
/*++

Routine Description:

    This routine parses the response from the server

Arguments:

    pServer            - the server instance

    pDomainName        - the domain name string to be extracted from the response

    pSmbHeader         - the response SMB

    BytesAvailable     - length of the response

    pBytesTaken        - response consumed

Return Value:

    STATUS_SUCCESS - the server call construction has been finalized.

    Other Status codes correspond to error situations.

Notes:

    The SMB servers can speak a variety of dialects of the SMB protocol. The initial
    negotiate response can come in one of three possible flavours. Either we get the
    NT negotiate response SMB from a NT server or the extended response from DOS and
    OS/2 servers or the CORE response from other servers.

--*/
{
    NTSTATUS        Status = STATUS_SUCCESS;

    PSMBCEDB_SERVER_ENTRY pServerEntry;
    PSMBCE_SERVER         pServer;
    PUNICODE_STRING       pDomainName;

    USHORT          DialectIndex;
    PRESP_NEGOTIATE pNegotiateResponse;
    ULONG           NegotiateSmbLength;

    ASSERT( pSmbHeader != NULL );

    pServerEntry = SmbCeGetExchangeServerEntry(pSmbAdminExchange);
    pServer = &pServerEntry->Server;

    if (sizeof(SMB_HEADER) + FIELD_OFFSET(RESP_NEGOTIATE, Buffer) > BytesIndicated) {
        *pBytesTaken = BytesAvailable;
        pServerEntry->ServerStatus = STATUS_INVALID_NETWORK_RESPONSE;
        return Status;
    }

    pDomainName = &pSmbAdminExchange->Negotiate.DomainName;

    pNegotiateResponse = (PRESP_NEGOTIATE) (pSmbHeader + 1);
    NegotiateSmbLength = sizeof(SMB_HEADER);
    *pBytesTaken       = NegotiateSmbLength;

    // Assume that the indicated response is sufficient. The only cases in which this
    // will not be TRUE is for the EXTENDED NEGOITIATE in which the security blob
    // is passed back. In all other cases the TDI imposed minimum of 128 bytes
    // subsumes the negotiate response.

    *pDataBufferPointer = NULL;
    *pDataSize          = 0;

    DialectIndex = SmbGetUshort( &pNegotiateResponse->DialectIndex );
    if (DialectIndex == (USHORT) -1) {
        // means server cannot accept any requests from
        *pBytesTaken = BytesAvailable;
        pServerEntry->ServerStatus = STATUS_REQUEST_NOT_ACCEPTED;

        return Status;
    }

    if (pNegotiateResponse->WordCount < 1 || DialectIndex > s_NumberOfDialects) {
        *pBytesTaken = BytesAvailable;
        pServerEntry->ServerStatus = STATUS_INVALID_NETWORK_RESPONSE;
        return Status;
    }

    // set the domain name length to zero ( default initialization )
    pDomainName->Length = 0;

    // Fix up the dialect type and the corresponding dispatch vector.
    pServer->Dialect        = (SMB_DIALECT)DialectIndex;
    pServer->DialectFlags   = MRxSmbDialectFlags[DialectIndex];
    pServer->pDispatch      = &s_SmbServerDispatchVectors[s_SmbDialects[DialectIndex].DispatchVectorIndex];

    // Parse the response based upon the type of negotiate response expected.

    switch (s_SmbDialects[DialectIndex].NegotiateType) {
    case SMB_NT_NEGOTIATE:
        {
            ULONG              NegotiateResponseLength;
            LARGE_INTEGER      ZeroTime;
            LARGE_INTEGER      LocalTimeBias;
            LARGE_INTEGER      ServerTimeBias;
            PRESP_NT_NEGOTIATE pNtNegotiateResponse = (PRESP_NT_NEGOTIATE) pNegotiateResponse;

            if (sizeof(SMB_HEADER) + FIELD_OFFSET(RESP_NT_NEGOTIATE, Buffer) > BytesAvailable) {
                *pBytesTaken = BytesAvailable;
                pServerEntry->ServerStatus = STATUS_INVALID_NETWORK_RESPONSE;
                return Status;
            }

            if (pNtNegotiateResponse->WordCount != 17) {
                *pBytesTaken = BytesAvailable;
                Status = STATUS_INVALID_NETWORK_RESPONSE;
            } else {
                // parse and map the capabilities.
                ULONG NtCapabilities;

                NegotiateResponseLength = FIELD_OFFSET(RESP_NT_NEGOTIATE,Buffer) +
                                          SmbGetUshort(&pNtNegotiateResponse->ByteCount);
                NegotiateSmbLength += NegotiateResponseLength;

                //Start with a clean slate
                pServer->Capabilities = 0;

                // Initialize server based constants
                pServer->MaximumRequests   = SmbGetUshort( &pNtNegotiateResponse->MaxMpxCount );
                pServer->MaximumVCs        = SmbGetUshort( &pNtNegotiateResponse->MaxNumberVcs );
                pServer->MaximumBufferSize = SmbGetUlong( &pNtNegotiateResponse->MaxBufferSize );

                NtCapabilities = pServer->NtServer.NtCapabilities = SmbGetUlong(&pNtNegotiateResponse->Capabilities);
                if (NtCapabilities & CAP_RAW_MODE) {
                    pServer->Capabilities |= (RAW_READ_CAPABILITY | RAW_WRITE_CAPABILITY);
                }

                if ((NtCapabilities & CAP_COMPRESSED_DATA) &&
                    MRxSmbEnableCompression) {
                    pServer->Capabilities |= COMPRESSED_DATA_CAPABILITY;
                }

                if (NtCapabilities & CAP_DFS) {
                    pServer->Capabilities |= CAP_DFS;
                }

                if (NtCapabilities & CAP_LWIO) {
                    pServer->Capabilities |= LWIO_CAPABILITY;
                }

                //copy other nt capabilities into the dialog flags

                if (NtCapabilities & CAP_UNICODE) {
                    pServer->DialectFlags |= DF_UNICODE;
                }

                if (NtCapabilities & CAP_LARGE_FILES) {
                    pServer->DialectFlags |= DF_LARGE_FILES;
                }

                if (NtCapabilities & CAP_NT_SMBS) {
                    pServer->DialectFlags |= DF_NT_SMBS | DF_NT_FIND;
                }

                if (NtCapabilities & CAP_NT_FIND) {
                    pServer->DialectFlags |= DF_NT_FIND;
                }

                if (NtCapabilities & CAP_RPC_REMOTE_APIS) {
                    pServer->DialectFlags |= DF_RPC_REMOTE;
                }

                if (NtCapabilities & CAP_NT_STATUS) {
                    pServer->DialectFlags |= DF_NT_STATUS;
                }

                if (NtCapabilities & CAP_LEVEL_II_OPLOCKS) {
                    pServer->DialectFlags |= DF_OPLOCK_LVL2;
                }

                if (NtCapabilities & CAP_LOCK_AND_READ) {
                    pServer->DialectFlags |= DF_LOCKREAD;
                }

                if (NtCapabilities & CAP_EXTENDED_SECURITY) {
                    pServer->DialectFlags |= DF_EXTENDED_SECURITY;
                }

                if (NtCapabilities & CAP_INFOLEVEL_PASSTHRU) {
                    pServer->DialectFlags |= DF_NT_INFO_PASSTHROUGH;
                }

                // For non disk files the LARGE_READX capability is not useful.
                pServer->MaximumNonDiskFileReadBufferSize =
                    pServer->MaximumBufferSize -
                    QuadAlign(
                        sizeof(SMB_HEADER) +
                        FIELD_OFFSET(
                            REQ_NT_READ_ANDX,
                            Buffer[0]));

                if (NtCapabilities & CAP_LARGE_READX) {
                    if (NtCapabilities & CAP_LARGE_WRITEX) {
                        pServer->MaximumDiskFileReadBufferSize = 60*1024;
                    } else {
                        // The maximum size for reads to servers which support
                        // large read and x is constrained by the USHORT to record
                        // lengths in the SMB. Thus the maximum length that can be used
                        // is (65536 - 1) . This length should accomodate the header as
                        // well as the rest of the SMB. Actually, tho, we cut back to 60K.
                        pServer->MaximumDiskFileReadBufferSize = 60*1024;
                    }
                } else {
                    pServer->MaximumDiskFileReadBufferSize = pServer->MaximumNonDiskFileReadBufferSize;
                }

                // Specifying a zero local time will give you the time zone bias
                ZeroTime.HighPart = ZeroTime.LowPart = 0;
                ExLocalTimeToSystemTime( &ZeroTime, &LocalTimeBias );

                ServerTimeBias = RtlEnlargedIntegerMultiply(
                                    (LONG)SmbGetUshort(
                                        &pNtNegotiateResponse->ServerTimeZone),
                                    ONE_MINUTE_IN_TIME );

                pServer->TimeZoneBias.QuadPart = ServerTimeBias.QuadPart -
                                                 LocalTimeBias.QuadPart;

                if (!FlagOn(pServer->DialectFlags,DF_NT_SMBS)) {
                    //sigh...........
                    pServer->DialectFlags &= ~(DF_MIXEDCASEPW);
                    pServer->DialectFlags |= DF_W95;
                }

                Status = GetNTSecurityParameters(
                             pSmbAdminExchange,
                             pServer,
                             pDomainName,
                             pNtNegotiateResponse,
                             BytesIndicated,
                             BytesAvailable,
                             pBytesTaken,
                             pDataBufferPointer,
                             pDataSize);

                pServer->MaximumNonDiskFileWriteBufferSize =
                    min(
                        MRxSmbSrvWriteBufSize,
                        pServer->MaximumBufferSize -
                        QuadAlign(
                            sizeof(SMB_HEADER) +
                            FIELD_OFFSET(
                                REQ_NT_WRITE_ANDX,
                                Buffer[0])));
                
                if (NtCapabilities & CAP_LARGE_WRITEX &&
                    !(MRxSmbSecuritySignaturesEnabled && pServer->SecuritySignaturesEnabled)) {
                    pServer->DialectFlags |= DF_LARGE_WRITEX;
                    pServer->MaximumDiskFileWriteBufferSize = 0x10000;
                } else {
                    pServer->MaximumDiskFileWriteBufferSize =
                        pServer->MaximumNonDiskFileWriteBufferSize;
                }
            }
        }
        break;

    case SMB_EXTENDED_NEGOTIATE :
        {
            // An SMB_EXTENDED_NEGOTIATE response is never partially indicated. The response
            // length is ithin the TDI minimum for indication.

            USHORT RawMode;

            // DOS or OS2 server
            if (pNegotiateResponse->WordCount != 13 &&
                pNegotiateResponse->WordCount != 10 &&  // some downlevel server returns invalid WordCount
                pNegotiateResponse->WordCount != 8) {
                Status = STATUS_INVALID_NETWORK_RESPONSE;
            } else {
                NegotiateSmbLength += FIELD_OFFSET(RESP_NEGOTIATE,Buffer) +
                                      SmbGetUshort(&pNegotiateResponse->ByteCount);

                if (BytesIndicated < NegotiateSmbLength) {
                    *pBytesTaken = BytesAvailable;
                    pServerEntry->ServerStatus = STATUS_INVALID_NETWORK_RESPONSE;
                    return Status;
                }

                RawMode = SmbGetUshort( &pNegotiateResponse->RawMode );
                pServer->Capabilities |= ((RawMode & 0x1) != 0
                                          ? RAW_READ_CAPABILITY : 0);
                pServer->Capabilities |= ((RawMode & 0x2) != 0
                                          ? RAW_WRITE_CAPABILITY : 0);

                if (pSmbHeader->Flags & SMB_FLAGS_LOCK_AND_READ_OK) {
                    pServer->DialectFlags |= DF_LOCKREAD;
                }

                pServer->EncryptPasswords = FALSE;
                pServer->MaximumVCs       = 1;

                pServer->MaximumBufferSize     = SmbGetUshort( &pNegotiateResponse->MaxBufferSize );
                pServer->MaximumDiskFileReadBufferSize =
                    pServer->MaximumBufferSize -
                    QuadAlign(
                        sizeof(SMB_HEADER) +
                        FIELD_OFFSET(
                            RESP_READ_ANDX,
                            Buffer[0]));

                pServer->MaximumNonDiskFileReadBufferSize  = pServer->MaximumDiskFileReadBufferSize;
                pServer->MaximumDiskFileWriteBufferSize    = pServer->MaximumDiskFileReadBufferSize;
                pServer->MaximumNonDiskFileWriteBufferSize = pServer->MaximumDiskFileReadBufferSize;

                pServer->MaximumRequests  = SmbGetUshort(
                                                &pNegotiateResponse->MaxMpxCount );
                pServer->MaximumVCs       = SmbGetUshort(
                                                &pNegotiateResponse->MaxNumberVcs );

                if (pNegotiateResponse->WordCount == 13) {
                    //CODE.IMPROVEMENT use the DF_bit for this
                    switch (pServer->Dialect) {
                    case LANMAN10_DIALECT:
                    case WFW10_DIALECT:
                    case LANMAN12_DIALECT:
                    case LANMAN21_DIALECT:
                        GetLanmanTimeBias( pServer,pNegotiateResponse );
                        break;
                    }

                    Status = GetLanmanSecurityParameters(pSmbAdminExchange,pServer,pNegotiateResponse,BytesIndicated);
                }
            }

            *pBytesTaken = BytesAvailable;
        }
        break;

    case SMB_CORE_NEGOTIATE :
    default :
        {
            // An SMB_CORE_NEGOTIATE response is never partially indicated. The response
            // length is ithin the TDI minimum for indication.

            pServer->SecurityMode = SECURITY_MODE_SHARE_LEVEL;
            pServer->EncryptPasswords = FALSE;
            pServer->MaximumBufferSize = 0;
            pServer->MaximumRequests = 1;
            pServer->MaximumVCs = 1;
            pServer->SessionKey = 0;

            if (pSmbHeader->Flags & SMB_FLAGS_OPLOCK) {
                pServer->DialectFlags |= DF_OPLOCK;
            }
            
            *pBytesTaken = BytesAvailable;
            ASSERT(BytesIndicated == BytesAvailable);
        }
    }

    if (pServer->MaximumRequests == 0) {
        //
        // If this is a Lanman 1.0 or better server, this is a invalid negotiate
        // response. For others it would have been set to 1.
        //
        Status = STATUS_INVALID_NETWORK_RESPONSE;
    }

    if ((Status == STATUS_SUCCESS) ||
        (Status == STATUS_MORE_PROCESSING_REQUIRED)) {
        // Note that this code relies on the minimum incication size covering
        // the negotiate response header.
        //  Check to make sure that the time zone bias isn't more than +-24
        //  hours.
        //
#ifndef WIN9X
        if ((pServer->TimeZoneBias.QuadPart > s_MaxTimeZoneBias.QuadPart) ||
            (-pServer->TimeZoneBias.QuadPart > s_MaxTimeZoneBias.QuadPart)) {
#else
        if ((pServer->TimeZoneBias.HighPart > s_MaxTimeZoneBias.HighPart) ||
            (-pServer->TimeZoneBias.HighPart > s_MaxTimeZoneBias.HighPart)) {
#endif

            //  Set the bias to 0 - assume local time zone.
            pServer->TimeZoneBias.LowPart = pServer->TimeZoneBias.HighPart = 0;
        }

        //  Do not allow negotiated buffersize to exceed the size of a USHORT.
        //  Remove 4096 bytes to avoid overrun and make it easier to handle
        //  than 0xffff

        pServer->MaximumBufferSize =
            (pServer->MaximumBufferSize < 0x00010000) ? pServer->MaximumBufferSize :
                                             0x00010000 - 4096;
    } else {
        pServerEntry->ServerStatus = Status;
        *pBytesTaken = BytesAvailable;
        Status = STATUS_SUCCESS;
    }

    if ((pServer->DialectFlags & DF_NTNEGOTIATE)!=0) {

        InterlockedIncrement(&MRxSmbStatistics.LanmanNtConnects);

    } else if ((pServer->DialectFlags & DF_LANMAN21)!=0) {

        InterlockedIncrement(&MRxSmbStatistics.Lanman21Connects);

    } else if ((pServer->DialectFlags & DF_LANMAN20)!=0) {

        InterlockedIncrement(&MRxSmbStatistics.Lanman20Connects);

    } else {

        InterlockedIncrement(&MRxSmbStatistics.CoreConnects);

    }

    if (pServer->MaximumRequests > (USHORT)MRxSmbConfiguration.MaximumNumberOfCommands) {
        pServer->MaximumRequests = (USHORT)MRxSmbConfiguration.MaximumNumberOfCommands; 
    }

    if (MRxSmbSecuritySignaturesRequired &&
        !pServer->SecuritySignaturesEnabled &&
        pServerEntry->ServerStatus == STATUS_SUCCESS ) {
        // the client refuses to connect to a server that doesn't support security
        // signature which is required by the client.
        pServerEntry->ServerStatus = STATUS_LOGIN_WKSTA_RESTRICTION;
    }

    return Status;
}

NTSTATUS
GetNTSecurityParameters(
    PSMB_ADMIN_EXCHANGE pSmbAdminExchange,
    PSMBCE_SERVER       pServer,
    PUNICODE_STRING     pDomainName,
    PRESP_NT_NEGOTIATE  pNtNegotiateResponse,
    ULONG               BytesIndicated,
    ULONG               BytesAvailable,
    PULONG              pBytesTaken,
    PMDL                *pDataBufferPointer,
    PULONG              pDataSize)
/*++

Routine Description:

    This routine extracts the security parameters from an NT server

Arguments:

    pServer                 - the server

    pDomainName             - the domain name

    pNtNegotiateResponse    - the response

    NegotiateResponseLength - size of the negotiate response

Return Value:

    STATUS_SUCCESS - implies that pServer is a valid instnace .

    Other Status codes correspond to error situations.

--*/
{
    NTSTATUS   Status = STATUS_SUCCESS;
    USHORT     ByteCount;
    PUSHORT    pByteCountInSmb =
               ((PUSHORT)((PUCHAR) pNtNegotiateResponse + 1)) +
               pNtNegotiateResponse->WordCount;
    PUCHAR     pBuffer = (PUCHAR)(pByteCountInSmb + 1);

    *pBytesTaken += FIELD_OFFSET(RESP_NT_NEGOTIATE,Buffer);

    ByteCount = SmbGetUshort(pByteCountInSmb);

    pServer->SecurityMode = (((pNtNegotiateResponse->SecurityMode & NEGOTIATE_USER_SECURITY) != 0)
                             ? SECURITY_MODE_USER_LEVEL
                             : SECURITY_MODE_SHARE_LEVEL);

    pServer->EncryptPasswords = ((pNtNegotiateResponse->SecurityMode & NEGOTIATE_ENCRYPT_PASSWORDS) != 0);
    pServer->EncryptionKeyLength = 0;

    pServer->SecuritySignaturesEnabled = ((pNtNegotiateResponse->SecurityMode &
                                           NEGOTIATE_SECURITY_SIGNATURES_ENABLED) != 0);
    pServer->SecuritySignaturesRequired = ((pNtNegotiateResponse->SecurityMode &
                                            NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) != 0);

    if (BooleanFlagOn(pServer->NtServer.NtCapabilities,CAP_EXTENDED_SECURITY)) {
        ULONG SecurityBlobLength;

        // The server supports the new security validation scheme. In such cases
        // the BLOB to be passed to the local security package is shipped as
        // part of the negotiate response.

        if ((ByteCount < sizeof(GUID)) ||
            (*pBytesTaken + sizeof(GUID) > BytesIndicated)) {
            *pBytesTaken = BytesAvailable;
            pSmbAdminExchange->Status = STATUS_INVALID_NETWORK_RESPONSE;
            return STATUS_SUCCESS;
        }

        // Extract the Server GUID
        RtlCopyMemory(
            &pServer->NtServer.ServerGuid,
            pBuffer,
            sizeof(GUID));

        *pBytesTaken += sizeof(GUID);

        if (pServer->NtServer.pSecurityBlob != NULL) {
            RxFreePool(pServer->NtServer.pSecurityBlob);
            pServer->NtServer.pSecurityBlob = NULL;
            pServer->NtServer.SecurityBlobLength = 0;
        }

        // Allocate the Blob and copy the security Blob from the response
        if ((SecurityBlobLength = ByteCount - sizeof(GUID)) > 0) {
            pServer->NtServer.pSecurityBlob = RxAllocatePoolWithTag(
                                                  NonPagedPool,
                                                  SecurityBlobLength,
                                                  MRXSMB_ADMIN_POOLTAG);

            if (pServer->NtServer.pSecurityBlob != NULL) {
                pServer->NtServer.SecurityBlobLength = SecurityBlobLength;

                // If the Blob has been completely indicated it can be copied directly.
                // On the other hand if it is not completely indicated an MDl needs to
                // be setup to allow the underlying TDI layer to complete the copy
                // into the allocated buffer. This entails allocating an MDL of the
                // appropriate size and setting it up.

                if ((*pBytesTaken + SecurityBlobLength) <= BytesIndicated) {
                    RtlCopyMemory(
                        pServer->NtServer.pSecurityBlob,
                        (pBuffer + sizeof(GUID)),
                        SecurityBlobLength);

                    *pBytesTaken += SecurityBlobLength;

                    ASSERT(*pBytesTaken == BytesAvailable);
                } else {
                    if ((*pBytesTaken + SecurityBlobLength) <= BytesAvailable) {
                        // In this case the blob was not indicated completely.
                        *pDataBufferPointer = RxAllocateMdl(
                                                  pServer->NtServer.pSecurityBlob,
                                                  SecurityBlobLength);

                        if (*pDataBufferPointer == NULL) {
                            RxFreePool(pServer->NtServer.pSecurityBlob);
                            pServer->NtServer.pSecurityBlob = NULL;
                            pServer->NtServer.SecurityBlobLength = 0;
                            Status = STATUS_INSUFFICIENT_RESOURCES;
                        } else {
                            MmBuildMdlForNonPagedPool(*pDataBufferPointer);
                            *pDataSize = SecurityBlobLength;
                            Status = STATUS_MORE_PROCESSING_REQUIRED;
                        }
                    } else {
                        *pBytesTaken = BytesAvailable;
                        Status = STATUS_SUCCESS;
                        pSmbAdminExchange->Status = STATUS_INVALID_NETWORK_RESPONSE;
                    }
                }
            } else {
                Status = STATUS_INSUFFICIENT_RESOURCES;
            }
        }
    } else {
        *pBytesTaken = BytesAvailable;

        pServer->SessionKey   = SmbGetUlong( &pNtNegotiateResponse->SessionKey );

        if (pServer->EncryptPasswords) {
            if (BytesIndicated < sizeof(SMB_HEADER) + FIELD_OFFSET(RESP_NT_NEGOTIATE, Buffer) + ByteCount ) {
                *pBytesTaken = BytesAvailable;
                pSmbAdminExchange->Status = STATUS_INVALID_NETWORK_RESPONSE;
                return STATUS_SUCCESS;
            }
            
            pServer->EncryptionKeyLength = pNtNegotiateResponse->EncryptionKeyLength;

            if (pServer->EncryptionKeyLength != 0) {

                ASSERT( CRYPT_TXT_LEN == MSV1_0_CHALLENGE_LENGTH );

                if (pServer->EncryptionKeyLength != CRYPT_TXT_LEN) {
                    Status = STATUS_INVALID_NETWORK_RESPONSE;
                } else {
                    RtlCopyMemory(
                        pServer->EncryptionKey,
                        pBuffer,
                        pServer->EncryptionKeyLength );

                    if (ByteCount - pServer->EncryptionKeyLength > 0) {
                        pBuffer = pBuffer + pServer->EncryptionKeyLength;
                        pDomainName->Length = ByteCount - pServer->EncryptionKeyLength;

                        if (pDomainName->Length <= pDomainName->MaximumLength) {
                            if (pDomainName->Length & 1) {
                                // The remainder of the length is odd. This implies that the server did
                                // some alignment.
                                pBuffer++;
                                pDomainName->Length -= 1;
                            }

                            RtlCopyMemory(
                                pDomainName->Buffer,
                                pBuffer,
                                pDomainName->Length);
                        } else {
                            pDomainName->Length = 0;
                            Status = STATUS_BUFFER_OVERFLOW;
                        }
                    }
                }
            }         
        }
    }

    return Status;
}

NTSTATUS
GetLanmanSecurityParameters(
    PSMB_ADMIN_EXCHANGE pSmbAdminExchange,
    PSMBCE_SERVER       pServer,
    PRESP_NEGOTIATE     pNegotiateResponse,
    ULONG               BytesIndicated)
/*++

Routine Description:

    This routine extracts the security parameters from a LANMAN server

Arguments:

    pServer              - the server

    pNtNegotiateResponse - the response

Return Value:

    STATUS_SUCCESS - implies that pServer is a valid instnace .

    Other Status codes correspond to error situations.

--*/
{

    USHORT i;
    USHORT SecurityMode;

    pServer->SessionKey = SmbGetUlong( &pNegotiateResponse->SessionKey );

    SecurityMode = SmbGetUshort( &pNegotiateResponse->SecurityMode );
    pServer->SecurityMode = (((SecurityMode & 1) != 0)
                             ? SECURITY_MODE_USER_LEVEL
                             : SECURITY_MODE_SHARE_LEVEL);
    pServer->EncryptPasswords = ((SecurityMode & 2) != 0);

    if (pServer->EncryptPasswords) {
        if (pServer->Dialect == LANMAN21_DIALECT) {
            pServer->EncryptionKeyLength = SmbGetUshort(&pNegotiateResponse->EncryptionKeyLength);
        } else {
            pServer->EncryptionKeyLength = SmbGetUshort(&pNegotiateResponse->ByteCount);
        }

        if (pServer->EncryptionKeyLength != 0) {
            if (pServer->EncryptionKeyLength > CRYPT_TXT_LEN) {
                return( STATUS_INVALID_NETWORK_RESPONSE );
            }

            if (BytesIndicated < sizeof(SMB_HEADER) + FIELD_OFFSET(RESP_NEGOTIATE, Buffer) + pServer->EncryptionKeyLength) {
                pSmbAdminExchange->Status = STATUS_INVALID_NETWORK_RESPONSE;
                return STATUS_SUCCESS;
            }
            
            for (i = 0; i < pServer->EncryptionKeyLength; i++) {
                pServer->EncryptionKey[i] = pNegotiateResponse->Buffer[i];
            }
        }
    }

    return( STATUS_SUCCESS );
}

LARGE_INTEGER
ConvertSmbTimeToTime (
    IN SMB_TIME Time,
    IN SMB_DATE Date
    )
/*++

Routine Description:

    This routine converts an SMB time to an NT time structure.

Arguments:

    IN SMB_TIME Time - Supplies the time of day to convert
    IN SMB_DATE Date - Supplies the day of the year to convert
    IN PSERVERLISTENTRY Server - if supplied, supplies the server for tz bias.

Return Value:

    LARGE_INTEGER - Time structure describing input time.


--*/

{
    TIME_FIELDS TimeFields;
    LARGE_INTEGER OutputTime;

    //
    // This routine cannot be paged because it is called from both the
    // RdrFileDiscardableSection and the RdrVCDiscardableSection.
    //

    if (SmbIsTimeZero(&Date) && SmbIsTimeZero(&Time)) {
        OutputTime.LowPart = OutputTime.HighPart = 0;
    } else {
        TimeFields.Year = Date.Struct.Year + (USHORT )1980;
        TimeFields.Month = Date.Struct.Month;
        TimeFields.Day = Date.Struct.Day;

        TimeFields.Hour = Time.Struct.Hours;
        TimeFields.Minute = Time.Struct.Minutes;
        TimeFields.Second = Time.Struct.TwoSeconds*(USHORT )2;
        TimeFields.Milliseconds = 0;

        //
        //  Make sure that the times specified in the SMB are reasonable
        //  before converting them.
        //

        if (TimeFields.Year < 1601) {
            TimeFields.Year = 1601;
        }

        if (TimeFields.Month > 12) {
            TimeFields.Month = 12;
        }

        if (TimeFields.Hour >= 24) {
            TimeFields.Hour = 23;
        }
        if (TimeFields.Minute >= 60) {
            TimeFields.Minute = 59;
        }
        if (TimeFields.Second >= 60) {
            TimeFields.Second = 59;

        }

        if (!RtlTimeFieldsToTime(&TimeFields, &OutputTime)) {
            OutputTime.HighPart = 0;
            OutputTime.LowPart = 0;

            return OutputTime;
        }

        ExLocalTimeToSystemTime(&OutputTime, &OutputTime);

    }

    return OutputTime;

}

VOID
GetLanmanTimeBias(
    PSMBCE_SERVER   pServer,
    PRESP_NEGOTIATE pNegotiateResponse)
/*++

Routine Description:

    This routine extracts the time bias from a Lanman server

Arguments:

    pServer              - the server

    pNtNegotiateResponse - the response

Return Value:

    STATUS_SUCCESS - implies that pServer is a valid instnace .

    Other Status codes correspond to error situations.

--*/
{
    //  If this is a LM 1.0 or 2.0 server (ie a non NT server), we
    //  remember the timezone and bias our time based on this value.
    //
    //  The redirector assumes that all times from these servers are
    //  local time for the server, and converts them to local time
    //  using this bias. It then tells the user the local time for
    //  the file on the server.
    LARGE_INTEGER Workspace, ServerTime, CurrentTime;
    BOOLEAN Negated = FALSE;
    SMB_TIME SmbServerTime;
    SMB_DATE SmbServerDate;

    SmbMoveTime(&SmbServerTime, &pNegotiateResponse->ServerTime);

    SmbMoveDate(&SmbServerDate, &pNegotiateResponse->ServerDate);

    ServerTime = ConvertSmbTimeToTime(SmbServerTime, SmbServerDate);

    KeQuerySystemTime(&CurrentTime);

#ifndef WIN9X
    Workspace.QuadPart = CurrentTime.QuadPart - ServerTime.QuadPart;
#else
    RxLiSubLi(&Workspace.QuadPart, &CurrentTime.QuadPart, &ServerTime.QuadPart);
#endif

    if ( Workspace.HighPart < 0) {
        //  avoid using -ve large integers to routines that accept only unsigned
#ifndef WIN9X
        Workspace.QuadPart = -Workspace.QuadPart;
#else
        Workspace.HighPart = -Workspace.HighPart;
        Workspace.LowPart = -Workspace.LowPart;
#endif
        Negated = TRUE;
    }

    //
    //  Workspace has the exact difference in 100ns intervals
    //  between the server and redirector times. To remove the minor
    //  difference between the time settings on the two machines we
    //  round the Bias to the nearest 30 minutes.
    //
    //  Calculate ((exact bias+15minutes)/30minutes)* 30minutes
    //  then convert back to the bias time.
    //

#ifndef WIN9X
    Workspace.QuadPart += ((LONGLONG) ONE_MINUTE_IN_TIME) * 15;

    //  Workspace is now  exact bias + 15 minutes in 100ns units

    Workspace.QuadPart /= ((LONGLONG) ONE_MINUTE_IN_TIME) * 30;

    pServer->TimeZoneBias.QuadPart = Workspace.QuadPart * ((LONGLONG) ONE_MINUTE_IN_TIME) * 30;
#else
    pServer->TimeZoneBias.HighPart = Workspace.HighPart;
    pServer->TimeZoneBias.LowPart = Workspace.LowPart;
#endif

    if ( Negated == TRUE ) {
#ifndef WIN9X
        pServer->TimeZoneBias.QuadPart = -pServer->TimeZoneBias.QuadPart;
#else
        pServer->TimeZoneBias.HighPart = -pServer->TimeZoneBias.HighPart;
        pServer->TimeZoneBias.LowPart = -pServer->TimeZoneBias.LowPart;
#endif
    }
}

NTSTATUS
MRxSmbCheckTransportName(
    IN  PIRP                  Irp,
    OUT PSMBCEDB_SERVER_ENTRY *ppServerEntry)
/*++

Routine Description:

    This routine implements the transport name checking on existing connection the server.

    If the tranport name is provided on the Irp, we have 3 cases:

     1. There is no connection to the the server requested;
     2. There is an existing connection to the server and the transport used by the connection has
        the same name as provided;
     3. There is an existing connection to the server and the transport used by the connection has
        the different name as provided.

    This routine will force to tear down the connection on case 3 and let the server reconnected
    on the new transport.

Arguments:

    Irp - Supplies the Irp being processed

Return Value:

    NTSTATUS - The return status for the operation

--*/
{
    PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation( Irp );
    PSMBCEDB_SERVER_ENTRY pServerEntry = NULL;
    NTSTATUS Status = STATUS_SUCCESS;
    PFILE_FULL_EA_INFORMATION pEaEntry;

    pEaEntry = (PFILE_FULL_EA_INFORMATION)Irp->AssociatedIrp.SystemBuffer;

    if ((pEaEntry != NULL) && (Irp->Flags & IRP_CREATE_OPERATION)) {
        if (IrpSp->Parameters.Create.Options & FILE_CREATE_TREE_CONNECTION) {
            for(;;) {
                if (strcmp(pEaEntry->EaName, EA_NAME_TRANSPORT) == 0) {
                    if (pEaEntry->EaValueLength > 0) {
                        RXCE_TRANSPORT  RxCeTransport;
                        USHORT          NameLength;
                        PUNICODE_STRING ServerName = &IrpSp->FileObject->FileName;
                        PUNICODE_STRING TransportName = NULL;

                        if (pEaEntry->EaValueLength > 0) {
                            TransportName = RxAllocatePoolWithTag(
                                                NonPagedPool,
                                                (sizeof(UNICODE_STRING) + pEaEntry->EaValueLength),
                                                MRXSMB_MISC_POOLTAG);
                        } else {
                            break;
                        }

                        if (TransportName != NULL) {
                            TransportName->Length        = pEaEntry->EaValueLength;
                            TransportName->MaximumLength = pEaEntry->EaValueLength;

                            TransportName->Buffer = (PWCHAR)((PCHAR)TransportName + sizeof(UNICODE_STRING));
                            RtlCopyMemory(
                                TransportName->Buffer,
                                pEaEntry->EaName + pEaEntry->EaNameLength + 1,
                                TransportName->Length);
                        } else {
                            Status = STATUS_INSUFFICIENT_RESOURCES;
                            break;
                        }

                        NameLength = ServerName->Length;

                        SmbCeAcquireResource();
                        pServerEntry = SmbCeGetFirstServerEntry();

                        while (pServerEntry != NULL) {
                            if ((NameLength > pServerEntry->Name.Length) &&
                                (ServerName->Buffer[pServerEntry->Name.Length/2] == OBJ_NAME_PATH_SEPARATOR)) {

                                ServerName->Length = pServerEntry->Name.Length;

                                if (RtlEqualUnicodeString(
                                    &pServerEntry->Name,
                                    ServerName,
                                    TRUE)) {

                                    if (pServerEntry->Header.State == SMBCEDB_CONSTRUCTION_IN_PROGRESS) {
                                        pServerEntry = NULL;
                                        Status = STATUS_CONNECTION_ACTIVE;

                                        break;
                                    }

                                    SmbCeReferenceServerEntry(pServerEntry);

                                    if (pServerEntry->pTransport != NULL) {
                                        RxCeTransport = pServerEntry->pTransport->pTransport->RxCeTransport;

                                        if (!RtlEqualUnicodeString(
                                            &RxCeTransport.Name,
                                            TransportName,
                                            TRUE)) {
                                            PSMBCE_TRANSPORT PreferredTransport;


                                            if (!MRxSmbBootedRemotely &&
                                                IsListEmpty(&pServerEntry->ActiveExchanges) &&
                                                (pServerEntry->Server.NumberOfSrvOpens == 0) && //needs to be fixed
                                                (InterlockedCompareExchange(&(pServerEntry->TransportSpecifiedByUser),1,0) == 0) &&
                                                ((PreferredTransport = SmbCeFindTransport(TransportName)) != NULL)) {

                                                if (pServerEntry->Server.NumberOfSrvOpens > 0) {
                                                    PSMBCEDB_NET_ROOT_ENTRY pNetRootEntry  = NULL;

                                                    pNetRootEntry = SmbCeGetFirstNetRootEntry(pServerEntry);
                                                    while (pNetRootEntry != NULL) {
                                                        RxFinalizeNetRoot((PNET_ROOT)pNetRootEntry->pRdbssNetRoot,TRUE,FALSE);
                                                        pNetRootEntry = SmbCeGetNextNetRootEntry(pServerEntry,pNetRootEntry);
                                                    }
                                                }

                                                RxDbgTrace(0, Dbg, ("Force tear down connection over Transport: %wZ\n", &RxCeTransport.Name));
                                                SmbCeTransportDisconnectIndicated(pServerEntry);
                                                RxDbgTrace(0, Dbg, ("Build connection over Transport: %wZ\n", TransportName));

                                                if (pServerEntry->PreferredTransport != NULL) {
                                                    SmbCeDereferenceTransport(pServerEntry->PreferredTransport);
                                                }

                                                pServerEntry->PreferredTransport = PreferredTransport;
                                            } else {
                                                SmbCeDereferenceServerEntry(pServerEntry);
                                                pServerEntry = NULL;
                                                Status = STATUS_CONNECTION_ACTIVE;
                                            }
                                        }
                                    }

                                    break;
                                }
                            }

                            pServerEntry = SmbCeGetNextServerEntry(pServerEntry);
                        }

                        SmbCeReleaseResource();

                        RxFreePool(TransportName);
                        ServerName->Length = NameLength;
                    }

                    break;
                } else {
                    if (pEaEntry->NextEntryOffset == 0) {
                        break;
                    } else
                        pEaEntry = (PFILE_FULL_EA_INFORMATION)
                                   ((PCHAR) pEaEntry + pEaEntry->NextEntryOffset);
                }
            }
        }
    }

    *ppServerEntry = pServerEntry;
    return Status;
}