Add SMB encryption. Still fixing client decrypt but

negotiation works.
Jeremy.
(This used to be commit d78045601af787731f0737b8627450018902b104)

9 files changed, 869 insertions, 74 deletions

diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c
index 994b10d6a8..f13393b764 100644
--- a/source3/smbd/aio.c
+++ b/source3/smbd/aio.c
@@ -236,7 +236,7 @@ bool schedule_aio_read_and_X(connection_struct *conn,
 	}
 
 	construct_reply_common((char *)req->inbuf, aio_ex->outbuf);
-	set_message(aio_ex->outbuf, 12, 0, True);
+	srv_set_message((const char *)req->inbuf, aio_ex->outbuf, 12, 0, True);
 	SCVAL(aio_ex->outbuf,smb_vwv0,0xFF); /* Never a chained reply. */
 
 	a = &aio_ex->acb;
@@ -387,6 +387,7 @@ static int handle_aio_read_complete(struct aio_extra *aio_ex)
 	int ret = 0;
 	int outsize;
 	char *outbuf = aio_ex->outbuf;
+	const char *inbuf = aio_ex->inbuf;
 	char *data = smb_buf(outbuf);
 	ssize_t nread = SMB_VFS_AIO_RETURN(aio_ex->fsp,&aio_ex->acb);
 
@@ -407,10 +408,11 @@ static int handle_aio_read_complete(struct aio_extra *aio_ex)
 			   "Error = %s\n",
 			   aio_ex->fsp->fsp_name, strerror(errno) ));
 
-		outsize = (UNIXERROR(ERRDOS,ERRnoaccess));
 		ret = errno;
+		ERROR_NT(map_nt_error_from_unix(ret));
+		outsize = srv_set_message(inbuf,outbuf,0,0,true);
 	} else {
-		outsize = set_message(outbuf,12,nread,False);
+		outsize = srv_set_message(inbuf, outbuf,12,nread,False);
 		SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be * -1. */
 		SSVAL(outbuf,smb_vwv5,nread);
 		SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
@@ -423,7 +425,7 @@ static int handle_aio_read_complete(struct aio_extra *aio_ex)
 			    (int)aio_ex->acb.aio_nbytes, (int)nread ) );
 
 	}
-	smb_setlen(outbuf,outsize - 4);
+	_smb_setlen(outbuf,outsize - 4);
 	show_msg(outbuf);
 	if (!send_smb(smbd_server_fd(),outbuf)) {
 		exit_server_cleanly("handle_aio_read_complete: send_smb "
@@ -448,6 +450,7 @@ static int handle_aio_write_complete(struct aio_extra *aio_ex)
 	int ret = 0;
 	files_struct *fsp = aio_ex->fsp;
 	char *outbuf = aio_ex->outbuf;
+	const char *inbuf = aio_ex->inbuf;
 	ssize_t numtowrite = aio_ex->acb.aio_nbytes;
 	ssize_t nwritten = SMB_VFS_AIO_RETURN(fsp,&aio_ex->acb);
 
@@ -492,8 +495,9 @@ static int handle_aio_write_complete(struct aio_extra *aio_ex)
 			return 0;
 		}
 
-		UNIXERROR(ERRHRD,ERRdiskfull);
 		ret = errno;
+		ERROR_BOTH(ERRHRD, ERRdiskfull, map_nt_error_from_unix(ret));
+		srv_set_message(inbuf,outbuf,0,0,true);
         } else {
 		bool write_through = BITSETW(aio_ex->inbuf+smb_vwv7,0);
 		NTSTATUS status;
@@ -509,8 +513,9 @@ static int handle_aio_write_complete(struct aio_extra *aio_ex)
 			 fsp->fnum, (int)numtowrite, (int)nwritten));
 		status = sync_file(fsp->conn,fsp, write_through);
 		if (!NT_STATUS_IS_OK(status)) {
-			UNIXERROR(ERRHRD,ERRdiskfull);
 			ret = errno;
+			ERROR_BOTH(ERRHRD, ERRdiskfull, map_nt_error_from_unix(ret));
+			srv_set_message(inbuf,outbuf,0,0,true);
                 	DEBUG(5,("handle_aio_write: sync_file for %s returned %s\n",
 				fsp->fsp_name, nt_errstr(status) ));
 		}
diff --git a/source3/smbd/error.c b/source3/smbd/error.c
index 12eff42023..c669e74146 100644
--- a/source3/smbd/error.c
+++ b/source3/smbd/error.c
@@ -24,34 +24,6 @@ extern struct unix_error_map unix_dos_nt_errmap[];
 
 extern uint32 global_client_caps;
 
-/****************************************************************************
- Create an error packet from errno.
-****************************************************************************/
-
-int unix_error_packet(char *outbuf,int def_class,uint32 def_code, NTSTATUS def_status, int line, const char *file)
-{
-	int eclass=def_class;
-	int ecode=def_code;
-	NTSTATUS ntstatus = def_status;
-	int i=0;
-
-	if (errno != 0) {
-		DEBUG(3,("unix_error_packet: error string = %s\n",strerror(errno)));
-  
-		while (unix_dos_nt_errmap[i].dos_class != 0) {
-			if (unix_dos_nt_errmap[i].unix_error == errno) {
-				eclass = unix_dos_nt_errmap[i].dos_class;
-				ecode = unix_dos_nt_errmap[i].dos_code;
-				ntstatus = unix_dos_nt_errmap[i].nt_error;
-				break;
-			}
-			i++;
-		}
-	}
-
-	return error_packet(outbuf,eclass,ecode,ntstatus,line,file);
-}
-
 bool use_nt_status(void)
 {
 	return lp_nt_status_support() && (global_client_caps & CAP_STATUS32);
@@ -109,9 +81,9 @@ void error_packet_set(char *outbuf, uint8 eclass, uint32 ecode, NTSTATUS ntstatu
 	}
 }
 
-int error_packet(char *outbuf, uint8 eclass, uint32 ecode, NTSTATUS ntstatus, int line, const char *file)
+int error_packet(const char *inbuf, char *outbuf, uint8 eclass, uint32 ecode, NTSTATUS ntstatus, int line, const char *file)
 {
-	int outsize = set_message(outbuf,0,0,True);
+	int outsize = srv_set_message(inbuf, outbuf,0,0,True);
 	error_packet_set(outbuf, eclass, ecode, ntstatus, line, file);
 	return outsize;
 }
@@ -150,8 +122,24 @@ void reply_both_error(struct smb_request *req, uint8 eclass, uint32 ecode,
 			 line, file);
 }
 
+void reply_openerror(struct smb_request *req, NTSTATUS status)
+{
+	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
+		/*
+		 * We hit an existing file, and if we're returning DOS
+		 * error codes OBJECT_NAME_COLLISION would map to
+		 * ERRDOS/183, we need to return ERRDOS/80, see bug
+		 * 4852.
+		 */
+		reply_botherror(req, NT_STATUS_OBJECT_NAME_COLLISION,
+			ERRDOS, ERRfilexists);
+	} else {
+		reply_nterror(req, status);
+	}
+}
+
 void reply_unix_error(struct smb_request *req, uint8 defclass, uint32 defcode,
-		      NTSTATUS defstatus, int line, const char *file)
+			NTSTATUS defstatus, int line, const char *file)
 {
 	int eclass=defclass;
 	int ecode=defcode;
@@ -163,7 +151,7 @@ void reply_unix_error(struct smb_request *req, uint8 defclass, uint32 defcode,
 
 	if (errno != 0) {
 		DEBUG(3,("unix_error_packet: error string = %s\n",
-			 strerror(errno)));
+			strerror(errno)));
 
 		while (unix_dos_nt_errmap[i].dos_class != 0) {
 			if (unix_dos_nt_errmap[i].unix_error == errno) {
@@ -177,22 +165,5 @@ void reply_unix_error(struct smb_request *req, uint8 defclass, uint32 defcode,
 	}
 
 	error_packet_set((char *)req->outbuf, eclass, ecode, ntstatus,
-			 line, file);
+		line, file);
 }
-
-void reply_openerror(struct smb_request *req, NTSTATUS status)
-{
-	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
-		/*
-		 * We hit an existing file, and if we're returning DOS
-		 * error codes OBJECT_NAME_COLLISION would map to
-		 * ERRDOS/183, we need to return ERRDOS/80, see bug
-		 * 4852.
-		 */
-		reply_botherror(req, NT_STATUS_OBJECT_NAME_COLLISION,
-			ERRDOS, ERRfilexists);
-	} else {
-		reply_nterror(req, status);
-	}
-}
-
diff --git a/source3/smbd/notify.c b/source3/smbd/notify.c
index 0dd7fbb20e..baab48f77e 100644
--- a/source3/smbd/notify.c
+++ b/source3/smbd/notify.c
@@ -131,6 +131,7 @@ static bool notify_marshall_changes(int num_changes,
 static void change_notify_reply_packet(const uint8 *request_buf,
 				       NTSTATUS error_code)
 {
+	const char *inbuf = (const char *)request_buf;
 	char outbuf[smb_size+38];
 
 	memset(outbuf, '\0', sizeof(outbuf));
@@ -142,7 +143,7 @@ static void change_notify_reply_packet(const uint8 *request_buf,
 	 * Seems NT needs a transact command with an error code
 	 * in it. This is a longer packet than a simple error.
 	 */
-	set_message(outbuf,18,0,False);
+	srv_set_message((const char *)request_buf, outbuf,18,0,False);
 
 	show_msg(outbuf);
 	if (!send_smb(smbd_server_fd(),outbuf))
diff --git a/source3/smbd/oplock.c b/source3/smbd/oplock.c
index 961abd277b..2c3313606a 100644
--- a/source3/smbd/oplock.c
+++ b/source3/smbd/oplock.c
@@ -252,7 +252,11 @@ static char *new_break_smb_message(TALLOC_CTX *mem_ctx,
 	}
 
 	memset(result,'\0',smb_size);
-	set_message(result,8,0,True);
+	/* We use cli_set_message here as this is an
+	 * asynchronous message that doesn't belong in
+	 * the stream.
+	 */
+	cli_set_message(result,8,0,True);
 	SCVAL(result,smb_com,SMBlockingX);
 	SSVAL(result,smb_tid,fsp->conn->cnum);
 	SSVAL(result,smb_pid,0xFFFF);
diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
index 0ddc00c767..88b67c03e5 100644
--- a/source3/smbd/pipes.c
+++ b/source3/smbd/pipes.c
@@ -291,7 +291,8 @@ void reply_pipe_read_and_X(struct smb_request *req)
 		return;
 	}
 
-	set_message((char *)req->outbuf, 12, nread, False);
+	srv_set_message((const char *)req->inbuf,
+		(char *)req->outbuf, 12, nread, False);
   
 	SSVAL(req->outbuf,smb_vwv5,nread);
 	SSVAL(req->outbuf,smb_vwv6,smb_offset(data,req->outbuf));
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index ee76f90bf5..1260d52c77 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -50,6 +50,43 @@ enum smb_read_errors *get_srv_read_error(void)
 	return &smb_read_error;
 }
 
+/*******************************************************************
+ Setup the word count and byte count for a smb message.
+ copying the '0xFF X X X' bytes from incoming
+ buffer (so we copy any encryption context).
+********************************************************************/
+
+int srv_set_message(const char *frombuf,
+                        char *buf,
+                        int num_words,
+                        int num_bytes,
+                        bool zero)
+{
+	if (zero && (num_words || num_bytes)) {
+		memset(buf + smb_size,'\0',num_words*2 + num_bytes);
+	}
+	SCVAL(buf,smb_wct,num_words);
+	SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
+	_smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
+	if (buf != frombuf) {
+		memcpy(buf+4, frombuf+4, 4);
+	}
+	return (smb_size + num_words*2 + num_bytes);
+}
+
+static bool valid_smb_header(const char *inbuf)
+{
+	if (srv_encryption_on()) {
+		uint16_t enc_num;
+		NTSTATUS status = get_enc_ctx_num(inbuf, &enc_num);
+		if (!NT_STATUS_IS_OK(status)) {
+			return false;
+		}
+		return (enc_num == 0);
+	}
+	return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
+}
+
 /* Socket functions for smbd packet processing. */
 
 static bool valid_packet_size(size_t len)
@@ -324,6 +361,18 @@ ssize_t receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd, char **buffer,
 		return -1;
 	}
 
+	if (srv_encryption_on()) {
+		NTSTATUS status = srv_decrypt_buffer(*buffer);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
+				"incoming packet! Error %s\n",
+				nt_errstr(status) ));
+			cond_set_smb_read_error(get_srv_read_error(),
+					SMB_READ_BAD_DECRYPT);
+			return -1;
+		}
+	}
+
 	/* Check the incoming SMB signature. */
 	if (!srv_check_sign_mac(*buffer, true)) {
 		DEBUG(0, ("receive_smb: SMB Signature verification failed on "
@@ -1239,7 +1288,8 @@ void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
 	}
 
 	construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
-	set_message((char *)req->outbuf, num_words, num_bytes, False);
+	srv_set_message((const char *)req->inbuf,
+			(char *)req->outbuf, num_words, num_bytes, false);
 	/*
 	 * Zero out the word area, the caller has to take care of the bcc area
 	 * himself
@@ -1309,7 +1359,7 @@ static void switch_message(uint8 type, struct smb_request *req, int size)
 
 	/* Make sure this is an SMB packet. smb_size contains NetBIOS header
 	 * so subtract 4 from it. */
-	if ((strncmp(smb_base(req->inbuf),"\377SMB",4) != 0)
+	if (!valid_smb_header((const char *)req->inbuf)
 	    || (size < (smb_size - 4))) {
 		DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
 			 smb_len(req->inbuf)));
@@ -1551,7 +1601,7 @@ void remove_from_common_flags2(uint32 v)
 
 void construct_reply_common(const char *inbuf, char *outbuf)
 {
-	set_message(outbuf,0,0,False);
+	srv_set_message(inbuf,outbuf,0,0,false);
 	
 	SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
 	SIVAL(outbuf,smb_rcls,0);
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 575ca13ff6..2707aee9c8 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -2791,8 +2791,8 @@ void reply_readbraw(connection_struct *conn, struct smb_request *req)
 
 	START_PROFILE(SMBreadbraw);
 
-	if (srv_is_signing_active()) {
-		exit_server_cleanly("reply_readbraw: SMB signing is active - "
+	if (srv_is_signing_active() || srv_encryption_on()) {
+		exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
 			"raw reads/writes are disallowed.");
 	}
 
@@ -3017,7 +3017,8 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 		return;
 	}
 	
-	set_message((char *)req->outbuf, 5, nread+3, False);
+	srv_set_message((const char *)req->inbuf,
+		(char *)req->outbuf, 5, nread+3, False);
 
 	SSVAL(req->outbuf,smb_vwv0,nread);
 	SSVAL(req->outbuf,smb_vwv5,nread+3);
@@ -3104,7 +3105,8 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 		return;
 	}
 
-	set_message((char *)req->outbuf, 5, nread+3, False);
+	srv_set_message((const char *)req->inbuf,
+		(char *)req->outbuf, 5, nread+3, False);
 
 	SSVAL(req->outbuf,smb_vwv0,nread);
 	SSVAL(req->outbuf,smb_vwv5,nread+3);
@@ -3122,12 +3124,12 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
  Setup readX header.
 ****************************************************************************/
 
-static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
+static int setup_readX_header(const char *inbuf, char *outbuf, size_t smb_maxcnt)
 {
 	int outsize;
 	char *data;
 
-	outsize = set_message(outbuf,12,smb_maxcnt,False);
+	outsize = srv_set_message(inbuf, outbuf,12,smb_maxcnt,False);
 	data = smb_buf(outbuf);
 
 	memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
@@ -3190,7 +3192,8 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
 		header = data_blob_const(headerbuf, sizeof(headerbuf));
 
 		construct_reply_common((char *)req->inbuf, (char *)headerbuf);
-		setup_readX_header((char *)headerbuf, smb_maxcnt);
+		setup_readX_header((const char *)req->inbuf,
+			(char *)headerbuf, smb_maxcnt);
 
 		if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, smb_maxcnt)) == -1) {
 			/* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
@@ -3241,7 +3244,8 @@ normal_read:
 		uint8 headerbuf[smb_size + 2*12];
 
 		construct_reply_common((char *)req->inbuf, (char *)headerbuf);
-		setup_readX_header((char *)headerbuf, smb_maxcnt);
+		setup_readX_header((const char *)req->inbuf,
+			(char *)headerbuf, smb_maxcnt);
 
 		/* Send out the header. */
 		if (write_data(smbd_server_fd(), (char *)headerbuf,
@@ -3268,7 +3272,8 @@ normal_read:
 			return;
 		}
 
-		setup_readX_header((char *)req->outbuf, nread);
+		setup_readX_header((const char *)req->inbuf,
+			(char *)req->outbuf, nread);
 
 		DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
 			fsp->fnum, (int)smb_maxcnt, (int)nread ) );
@@ -3332,8 +3337,8 @@ void reply_read_and_X(connection_struct *conn, struct smb_request *req)
 				END_PROFILE(SMBreadX);
 				return;
 			}
-			/* We currently don't do this on signed data. */
-			if (srv_is_signing_active()) {
+			/* We currently don't do this on signed or sealed data. */
+			if (srv_is_signing_active() || srv_encryption_on()) {
 				reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
 				END_PROFILE(SMBreadX);
 				return;
@@ -3524,7 +3529,7 @@ void reply_writebraw(connection_struct *conn, struct smb_request *req)
 	 * it to send more bytes */
 
 	memcpy(buf, req->inbuf, smb_size);
-	outsize = set_message(buf,
+	outsize = srv_set_message((const char *)req->inbuf, buf,
 			Protocol>PROTOCOL_COREPLUS?1:0,0,True);
 	SCVAL(buf,smb_com,SMBwritebraw);
 	SSVALS(buf,smb_vwv0,0xFFFF);
@@ -3856,6 +3861,12 @@ bool is_valid_writeX_buffer(const char *inbuf)
 	unsigned int doff = 0;
 	size_t len = smb_len_large(inbuf);
 
+	if (srv_encryption_on()) {
+		/* Can't do this on encrypted
+		 * connections. */
+		return false;
+	}
+
 	if (CVAL(inbuf,smb_com) != SMBwriteX) {
 		return false;
 	}
diff --git a/source3/smbd/seal.c b/source3/smbd/seal.c
new file mode 100644
index 0000000000..14a427bb9c
--- /dev/null
+++ b/source3/smbd/seal.c
@@ -0,0 +1,703 @@
+/* 
+   Unix SMB/CIFS implementation.
+   SMB Transport encryption (sealing) code - server code.
+   Copyright (C) Jeremy Allison 2007.
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+
+/******************************************************************************
+ Server side encryption.
+******************************************************************************/
+
+/******************************************************************************
+ Global server state.
+******************************************************************************/
+
+struct smb_srv_trans_enc_ctx {
+	struct smb_trans_enc_state *es;
+	AUTH_NTLMSSP_STATE *auth_ntlmssp_state; /* Must be kept in sync with pointer in ec->ntlmssp_state. */
+};
+
+static struct smb_srv_trans_enc_ctx *partial_srv_trans_enc_ctx;
+static struct smb_srv_trans_enc_ctx *srv_trans_enc_ctx;
+
+/******************************************************************************
+ Is server encryption on ?
+******************************************************************************/
+
+bool srv_encryption_on(void)
+{
+	if (srv_trans_enc_ctx) {
+		return common_encryption_on(srv_trans_enc_ctx->es);
+	}
+	return false;
+}
+
+/******************************************************************************
+ Create an auth_ntlmssp_state and ensure pointer copy is correct.
+******************************************************************************/
+
+static NTSTATUS make_auth_ntlmssp(struct smb_srv_trans_enc_ctx *ec)
+{
+	NTSTATUS status = auth_ntlmssp_start(&ec->auth_ntlmssp_state);
+	if (!NT_STATUS_IS_OK(status)) {
+		return nt_status_squash(status);
+	}
+
+	/*
+	 * We must remember to update the pointer copy for the common
+	 * functions after any auth_ntlmssp_start/auth_ntlmssp_end.
+	 */
+	ec->es->s.ntlmssp_state = ec->auth_ntlmssp_state->ntlmssp_state;
+	return status;
+}
+
+/******************************************************************************
+ Destroy an auth_ntlmssp_state and ensure pointer copy is correct.
+******************************************************************************/
+
+static void destroy_auth_ntlmssp(struct smb_srv_trans_enc_ctx *ec)
+{
+	/*
+	 * We must remember to update the pointer copy for the common
+	 * functions after any auth_ntlmssp_start/auth_ntlmssp_end.
+	 */
+
+	if (ec->auth_ntlmssp_state) {
+		auth_ntlmssp_end(&ec->auth_ntlmssp_state);
+		/* The auth_ntlmssp_end killed this already. */
+		ec->es->s.ntlmssp_state = NULL;
+	}
+}
+
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+
+/******************************************************************************
+ Import a name.
+******************************************************************************/
+
+static NTSTATUS get_srv_gss_creds(const char *service,
+				const char *name,
+				gss_cred_usage_t cred_type,
+				gss_cred_id_t *p_srv_cred)
+{
+	OM_uint32 ret;
+	OM_uint32 min;
+	gss_name_t srv_name;
+	gss_buffer_desc input_name;
+	char *host_princ_s = NULL;
+	NTSTATUS status = NT_STATUS_OK;
+
+	gss_OID_desc nt_hostbased_service =
+	{10, CONST_DISCARD(char *,"\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x04")};
+
+	asprintf(&host_princ_s, "%s@%s", service, name);
+	if (host_princ_s == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	input_name.value = host_princ_s;
+	input_name.length = strlen(host_princ_s) + 1;
+
+	ret = gss_import_name(&min,
+				&input_name,
+				&nt_hostbased_service,
+				&srv_name);
+
+	DEBUG(10,("get_srv_gss_creds: imported name %s\n",
+		host_princ_s ));
+
+	if (ret != GSS_S_COMPLETE) {
+		SAFE_FREE(host_princ_s);
+		return map_nt_error_from_gss(ret, min);
+	}
+
+	/*
+	 * We're accessing the krb5.keytab file here.
+ 	 * ensure we have permissions to do so.
+ 	 */
+	become_root();
+
+	ret = gss_acquire_cred(&min,
+				srv_name,
+				GSS_C_INDEFINITE,
+				GSS_C_NULL_OID_SET,
+				cred_type,
+				p_srv_cred,
+				NULL,
+				NULL);
+	unbecome_root();
+
+	if (ret != GSS_S_COMPLETE) {
+		ADS_STATUS adss = ADS_ERROR_GSS(ret, min);
+		DEBUG(10,("get_srv_gss_creds: gss_acquire_cred failed with %s\n",
+			ads_errstr(adss)));
+		status = map_nt_error_from_gss(ret, min);
+	}
+
+	SAFE_FREE(host_princ_s);
+	gss_release_name(&min, &srv_name);
+	return status;
+}
+
+/******************************************************************************
+ Create a gss state.
+ Try and get the cifs/server@realm principal first, then fall back to
+ host/server@realm.
+******************************************************************************/
+
+static NTSTATUS make_auth_gss(struct smb_srv_trans_enc_ctx *ec)
+{
+	NTSTATUS status;
+	gss_cred_id_t srv_cred;
+	fstring fqdn;
+
+	name_to_fqdn(fqdn, global_myname());
+	strlower_m(fqdn);
+
+	status = get_srv_gss_creds("cifs", fqdn, GSS_C_ACCEPT, &srv_cred);
+	if (!NT_STATUS_IS_OK(status)) {
+		status = get_srv_gss_creds("host", fqdn, GSS_C_ACCEPT, &srv_cred);
+		if (!NT_STATUS_IS_OK(status)) {
+			return nt_status_squash(status);
+		}
+	}
+
+	ec->es->s.gss_state = SMB_MALLOC_P(struct smb_tran_enc_state_gss);
+	if (!ec->es->s.gss_state) {
+		OM_uint32 min;
+		gss_release_cred(&min, &srv_cred);
+		return NT_STATUS_NO_MEMORY;
+	}
+	ZERO_STRUCTP(ec->es->s.gss_state);
+	ec->es->s.gss_state->creds = srv_cred;
+
+	/* No context yet. */
+	ec->es->s.gss_state->gss_ctx = GSS_C_NO_CONTEXT;
+
+	return NT_STATUS_OK;
+}
+#endif
+
+/******************************************************************************
+ Shutdown a server encryption context.
+******************************************************************************/
+
+static void srv_free_encryption_context(struct smb_srv_trans_enc_ctx **pp_ec)
+{
+	struct smb_srv_trans_enc_ctx *ec = *pp_ec;
+
+	if (!ec) {
+		return;
+	}
+
+	if (ec->es) {
+		switch (ec->es->smb_enc_type) {
+			case SMB_TRANS_ENC_NTLM:
+				destroy_auth_ntlmssp(ec);
+				break;
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+			case SMB_TRANS_ENC_GSS:
+				break;
+#endif
+		}
+		common_free_encryption_state(&ec->es);
+	}
+
+	SAFE_FREE(ec);
+	*pp_ec = NULL;
+}
+
+/******************************************************************************
+ Create a server encryption context.
+******************************************************************************/
+
+static NTSTATUS make_srv_encryption_context(enum smb_trans_enc_type smb_enc_type, struct smb_srv_trans_enc_ctx **pp_ec)
+{
+	struct smb_srv_trans_enc_ctx *ec;
+
+	*pp_ec = NULL;
+
+	ec = SMB_MALLOC_P(struct smb_srv_trans_enc_ctx);
+	if (!ec) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	ZERO_STRUCTP(partial_srv_trans_enc_ctx);
+	ec->es = SMB_MALLOC_P(struct smb_trans_enc_state);
+	if (!ec->es) {
+		SAFE_FREE(ec);
+		return NT_STATUS_NO_MEMORY;
+	}
+	ZERO_STRUCTP(ec->es);
+	ec->es->smb_enc_type = smb_enc_type;
+	switch (smb_enc_type) {
+		case SMB_TRANS_ENC_NTLM:
+			{
+				NTSTATUS status = make_auth_ntlmssp(ec);
+				if (!NT_STATUS_IS_OK(status)) {
+					srv_free_encryption_context(&ec);
+					return status;
+				}
+			}
+			break;
+
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+		case SMB_TRANS_ENC_GSS:
+			/* Acquire our credentials by calling gss_acquire_cred here. */
+			{
+				NTSTATUS status = make_auth_gss(ec);
+				if (!NT_STATUS_IS_OK(status)) {
+					srv_free_encryption_context(&ec);
+					return status;
+				}
+			}
+			break;
+#endif
+		default:
+			srv_free_encryption_context(&ec);
+			return NT_STATUS_INVALID_PARAMETER;
+	}
+	*pp_ec = ec;
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Free an encryption-allocated buffer.
+******************************************************************************/
+
+void srv_free_enc_buffer(char *buf)
+{
+	/* We know this is an smb buffer, and we
+	 * didn't malloc, only copy, for a keepalive,
+	 * so ignore session keepalives. */
+
+	if(CVAL(buf,0) == SMBkeepalive) {
+		return;
+	}
+
+	if (srv_trans_enc_ctx) {
+		common_free_enc_buffer(srv_trans_enc_ctx->es, buf);
+	}
+}
+
+/******************************************************************************
+ Decrypt an incoming buffer.
+******************************************************************************/
+
+NTSTATUS srv_decrypt_buffer(char *buf)
+{
+	/* Ignore session keepalives. */
+	if(CVAL(buf,0) == SMBkeepalive) {
+		return NT_STATUS_OK;
+	}
+
+	if (srv_trans_enc_ctx) {
+		return common_decrypt_buffer(srv_trans_enc_ctx->es, buf);
+	}
+
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Encrypt an outgoing buffer. Return the encrypted pointer in buf_out.
+******************************************************************************/
+
+NTSTATUS srv_encrypt_buffer(char *buf, char **buf_out)
+{
+	*buf_out = buf;
+
+	/* Ignore session keepalives. */
+	if(CVAL(buf,0) == SMBkeepalive) {
+		return NT_STATUS_OK;
+	}
+
+	if (srv_trans_enc_ctx) {
+		return common_encrypt_buffer(srv_trans_enc_ctx->es, buf, buf_out);
+	}
+	/* Not encrypting. */
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Do the gss encryption negotiation. Parameters are in/out.
+ Until success we do everything on the partial enc ctx.
+******************************************************************************/
+
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+static NTSTATUS srv_enc_spnego_gss_negotiate(unsigned char **ppdata, size_t *p_data_size, DATA_BLOB secblob)
+{
+	OM_uint32 ret;
+	OM_uint32 min;
+	OM_uint32 flags = 0;
+	gss_buffer_desc in_buf, out_buf;
+	struct smb_tran_enc_state_gss *gss_state;
+	DATA_BLOB auth_reply = data_blob_null;
+	DATA_BLOB response = data_blob_null;
+	NTSTATUS status;
+
+	if (!partial_srv_trans_enc_ctx) {
+		status = make_srv_encryption_context(SMB_TRANS_ENC_GSS, &partial_srv_trans_enc_ctx);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+	}
+
+	gss_state = partial_srv_trans_enc_ctx->es->s.gss_state;
+
+	in_buf.value = secblob.data;
+	in_buf.length = secblob.length;
+
+	out_buf.value = NULL;
+	out_buf.length = 0;
+
+	become_root();
+
+	ret = gss_accept_sec_context(&min,
+				&gss_state->gss_ctx,
+				gss_state->creds,
+				&in_buf,
+				GSS_C_NO_CHANNEL_BINDINGS,
+				NULL,
+				NULL,		/* Ignore oids. */
+				&out_buf,	/* To return. */
+				&flags,
+				NULL,		/* Ingore time. */
+				NULL);		/* Ignore delegated creds. */
+	unbecome_root();
+
+	status = gss_err_to_ntstatus(ret, min);
+	if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
+		return status;
+	}
+
+	/* Ensure we've got sign+seal available. */
+	if (ret == GSS_S_COMPLETE) {
+		if ((flags & (GSS_C_INTEG_FLAG|GSS_C_CONF_FLAG|GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) !=
+				(GSS_C_INTEG_FLAG|GSS_C_CONF_FLAG|GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) {
+			DEBUG(0,("srv_enc_spnego_gss_negotiate: quality of service not good enough "
+				"for SMB sealing.\n"));
+			gss_release_buffer(&min, &out_buf);
+			return NT_STATUS_ACCESS_DENIED;
+		}
+	}
+
+	auth_reply = data_blob(out_buf.value, out_buf.length);
+	gss_release_buffer(&min, &out_buf);
+
+	/* Wrap in SPNEGO. */
+	response = spnego_gen_auth_response(&auth_reply, status, OID_KERBEROS5);
+	data_blob_free(&auth_reply);
+
+	SAFE_FREE(*ppdata);
+	*ppdata = response.data;
+	*p_data_size = response.length;
+
+	return status;
+}
+#endif
+
+/******************************************************************************
+ Do the NTLM SPNEGO (or raw) encryption negotiation. Parameters are in/out.
+ Until success we do everything on the partial enc ctx.
+******************************************************************************/
+
+static NTSTATUS srv_enc_ntlm_negotiate(unsigned char **ppdata, size_t *p_data_size, DATA_BLOB secblob, bool spnego_wrap)
+{
+	NTSTATUS status;
+	DATA_BLOB chal = data_blob_null;
+	DATA_BLOB response = data_blob_null;
+
+	status = make_srv_encryption_context(SMB_TRANS_ENC_NTLM, &partial_srv_trans_enc_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = auth_ntlmssp_update(partial_srv_trans_enc_ctx->auth_ntlmssp_state, secblob, &chal);
+
+	/* status here should be NT_STATUS_MORE_PROCESSING_REQUIRED
+	 * for success ... */
+
+	if (spnego_wrap) {
+		response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
+		data_blob_free(&chal);
+	} else {
+		/* Return the raw blob. */
+		response = chal;
+	}
+
+	SAFE_FREE(*ppdata);
+	*ppdata = response.data;
+	*p_data_size = response.length;
+	return status;
+}
+
+/******************************************************************************
+ Do the SPNEGO encryption negotiation. Parameters are in/out.
+ Based off code in smbd/sesssionsetup.c
+ Until success we do everything on the partial enc ctx.
+******************************************************************************/
+
+static NTSTATUS srv_enc_spnego_negotiate(connection_struct *conn,
+					unsigned char **ppdata,
+					size_t *p_data_size,
+					unsigned char **pparam,
+					size_t *p_param_size)
+{
+	NTSTATUS status;
+	DATA_BLOB blob = data_blob_null;
+	DATA_BLOB secblob = data_blob_null;
+	bool got_kerberos_mechanism = false;
+
+	blob = data_blob_const(*ppdata, *p_data_size);
+
+	status = parse_spnego_mechanisms(blob, &secblob, &got_kerberos_mechanism);
+	if (!NT_STATUS_IS_OK(status)) {
+		return nt_status_squash(status);
+	}
+
+	/* We should have no partial context at this point. */
+
+	srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+	if (got_kerberos_mechanism && lp_use_kerberos_keytab() ) {
+		status = srv_enc_spnego_gss_negotiate(ppdata, p_data_size, secblob);
+	} else 
+#endif
+	{
+		status = srv_enc_ntlm_negotiate(ppdata, p_data_size, secblob, true);
+	}
+
+	data_blob_free(&secblob);
+
+	if (!NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
+		srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+		return nt_status_squash(status);
+	}
+
+	if (NT_STATUS_IS_OK(status)) {
+		/* Return the context we're using for this encryption state. */
+		if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		SSVAL(*pparam,0,partial_srv_trans_enc_ctx->es->enc_ctx_num);
+		*p_param_size = 2;
+	}
+
+	return status;
+}
+
+/******************************************************************************
+ Complete a SPNEGO encryption negotiation. Parameters are in/out.
+ We only get this for a NTLM auth second stage.
+******************************************************************************/
+
+static NTSTATUS srv_enc_spnego_ntlm_auth(connection_struct *conn,
+					unsigned char **ppdata,
+					size_t *p_data_size,
+					unsigned char **pparam,
+					size_t *p_param_size)
+{
+	NTSTATUS status;
+	DATA_BLOB blob = data_blob_null;
+	DATA_BLOB auth = data_blob_null;
+	DATA_BLOB auth_reply = data_blob_null;
+	DATA_BLOB response = data_blob_null;
+	struct smb_srv_trans_enc_ctx *ec = partial_srv_trans_enc_ctx;
+
+	/* We must have a partial context here. */
+
+	if (!ec || !ec->es || ec->auth_ntlmssp_state == NULL || ec->es->smb_enc_type != SMB_TRANS_ENC_NTLM) {
+		srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	blob = data_blob_const(*ppdata, *p_data_size);
+	if (!spnego_parse_auth(blob, &auth)) {
+		srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	status = auth_ntlmssp_update(ec->auth_ntlmssp_state, auth, &auth_reply);
+	data_blob_free(&auth);
+
+	response = spnego_gen_auth_response(&auth_reply, status, OID_NTLMSSP);
+	data_blob_free(&auth_reply);
+
+	if (NT_STATUS_IS_OK(status)) {
+		/* Return the context we're using for this encryption state. */
+		if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		SSVAL(*pparam,0,ec->es->enc_ctx_num);
+		*p_param_size = 2;
+	}
+
+	SAFE_FREE(*ppdata);
+	*ppdata = response.data;
+	*p_data_size = response.length;
+	return status;
+}
+
+/******************************************************************************
+ Raw NTLM encryption negotiation. Parameters are in/out.
+ This function does both steps.
+******************************************************************************/
+
+static NTSTATUS srv_enc_raw_ntlm_auth(connection_struct *conn,
+					unsigned char **ppdata,
+					size_t *p_data_size,
+					unsigned char **pparam,
+					size_t *p_param_size)
+{
+	NTSTATUS status;
+	DATA_BLOB blob = data_blob_const(*ppdata, *p_data_size);
+	DATA_BLOB response = data_blob_null;
+	struct smb_srv_trans_enc_ctx *ec;
+
+	if (!partial_srv_trans_enc_ctx) {
+		/* This is the initial step. */
+		status = srv_enc_ntlm_negotiate(ppdata, p_data_size, blob, false);
+		if (!NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
+			srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+			return nt_status_squash(status);
+		}
+		return status;
+	}
+
+	ec = partial_srv_trans_enc_ctx;
+	if (!ec || !ec->es || ec->auth_ntlmssp_state == NULL || ec->es->smb_enc_type != SMB_TRANS_ENC_NTLM) {
+		srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	/* Second step. */
+	status = auth_ntlmssp_update(partial_srv_trans_enc_ctx->auth_ntlmssp_state, blob, &response);
+
+	if (NT_STATUS_IS_OK(status)) {
+		/* Return the context we're using for this encryption state. */
+		if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		SSVAL(*pparam,0,ec->es->enc_ctx_num);
+		*p_param_size = 2;
+	}
+
+	/* Return the raw blob. */
+	SAFE_FREE(*ppdata);
+	*ppdata = response.data;
+	*p_data_size = response.length;
+	return status;
+}
+
+/******************************************************************************
+ Do the SPNEGO encryption negotiation. Parameters are in/out.
+******************************************************************************/
+
+NTSTATUS srv_request_encryption_setup(connection_struct *conn,
+					unsigned char **ppdata,
+					size_t *p_data_size,
+					unsigned char **pparam,
+					size_t *p_param_size)
+{
+	unsigned char *pdata = *ppdata;
+
+	SAFE_FREE(*pparam);
+	*p_param_size = 0;
+
+	if (*p_data_size < 1) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (pdata[0] == ASN1_APPLICATION(0)) {
+		/* its a negTokenTarg packet */
+		return srv_enc_spnego_negotiate(conn, ppdata, p_data_size, pparam, p_param_size);
+	}
+
+	if (pdata[0] == ASN1_CONTEXT(1)) {
+		/* It's an auth packet */
+		return srv_enc_spnego_ntlm_auth(conn, ppdata, p_data_size, pparam, p_param_size);
+	}
+
+	/* Maybe it's a raw unwrapped auth ? */
+	if (*p_data_size < 7) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (strncmp((char *)pdata, "NTLMSSP", 7) == 0) {
+		return srv_enc_raw_ntlm_auth(conn, ppdata, p_data_size, pparam, p_param_size);
+	}
+
+	DEBUG(1,("srv_request_encryption_setup: Unknown packet\n"));
+
+	return NT_STATUS_LOGON_FAILURE;
+}
+
+/******************************************************************************
+ Negotiation was successful - turn on server-side encryption.
+******************************************************************************/
+
+static NTSTATUS check_enc_good(struct smb_srv_trans_enc_ctx *ec)
+{
+	if (!ec || !ec->es) {
+		return NT_STATUS_LOGON_FAILURE;
+	}
+
+	if (ec->es->smb_enc_type == SMB_TRANS_ENC_NTLM) {
+		if ((ec->es->s.ntlmssp_state->neg_flags & (NTLMSSP_NEGOTIATE_SIGN|NTLMSSP_NEGOTIATE_SEAL)) !=
+				(NTLMSSP_NEGOTIATE_SIGN|NTLMSSP_NEGOTIATE_SEAL)) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+	}
+	/* Todo - check gssapi case. */
+
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Negotiation was successful - turn on server-side encryption.
+******************************************************************************/
+
+NTSTATUS srv_encryption_start(connection_struct *conn)
+{
+	NTSTATUS status;
+
+	/* Check that we are really doing sign+seal. */
+	status = check_enc_good(partial_srv_trans_enc_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	/* Throw away the context we're using currently (if any). */
+	srv_free_encryption_context(&srv_trans_enc_ctx);
+
+	/* Steal the partial pointer. Deliberate shallow copy. */
+	srv_trans_enc_ctx = partial_srv_trans_enc_ctx;
+	srv_trans_enc_ctx->es->enc_on = true;
+
+	partial_srv_trans_enc_ctx = NULL;
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Shutdown all server contexts.
+******************************************************************************/
+
+void server_encryption_shutdown(void)
+{
+	srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+	srv_free_encryption_context(&srv_trans_enc_ctx);
+}
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index e37f6ffbfd..0e34284443 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -2998,6 +2998,55 @@ cap_low = 0x%x, cap_high = 0x%x\n",
 				}
 				break;
 			}
+
+		case SMB_REQUEST_TRANSPORT_ENCRYPTION:
+			{
+				NTSTATUS status;
+				size_t param_len = 0;
+				size_t data_len = total_data;
+
+				if (!lp_unix_extensions()) {
+					reply_nterror(
+						req,
+						NT_STATUS_INVALID_LEVEL);
+					return;
+				}
+
+				DEBUG( 4,("call_trans2setfsinfo: "
+					"request transport encrption.\n"));
+
+				status = srv_request_encryption_setup(conn,
+								(unsigned char **)ppdata,
+								&data_len,
+								(unsigned char **)pparams,
+								&param_len);
+
+				if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
+						!NT_STATUS_IS_OK(status)) {
+					reply_nterror(req, status);
+					return;
+				}
+
+				send_trans2_replies(req,
+						*pparams,
+						param_len,
+						*ppdata,
+						data_len,
+						max_data_bytes);
+
+				if (NT_STATUS_IS_OK(status)) {
+					/* Server-side transport
+					 * encryption is now *on*. */
+					status = srv_encryption_start(conn);
+					if (!NT_STATUS_IS_OK(status)) {
+						exit_server_cleanly(
+							"Failure in setting "
+							"up encrypted transport");
+					}
+				}
+				return;
+			}
+
 		case SMB_FS_QUOTA_INFORMATION:
 			{
 				files_struct *fsp = NULL;