Changeset 988 for vendor/current/source3/smbd/signing.c

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

File:

• vendor/current/source3/smbd/signing.c (modified) (16 diffs)

vendor/current/source3/smbd/signing.c

@@ -23 +23 @@
 #include "smbd/smbd.h"
 #include "smbd/globals.h"
-#include "smb_signing.h"
+#include "../libcli/smb/smb_signing.h"
+#include "lib/param/param.h"
 
 /***********************************************************
@@ -29 +30 @@
 ************************************************************/
 
-bool srv_check_sign_mac(struct smbd_server_connection *conn,
+bool srv_check_sign_mac(struct smbXsrv_connection *conn,
                         const char *inbuf, uint32_t *seqnum,
                         bool trusted_channel)
 {
+        const uint8_t *inhdr;
+        size_t len;
+
         /* Check if it's a non-session message. */
         if(CVAL(inbuf,0)) {
@@ -38 +42 @@
         }
 
+        len = smb_len(inbuf);
+        inhdr = (const uint8_t *)inbuf + NBT_HDR_SIZE;
+
         if (trusted_channel) {
                 NTSTATUS status;
 
-                if (smb_len(inbuf) < (smb_ss_field + 8 - 4)) {
+                if (len < (HDR_SS_FIELD + 8)) {
                         DEBUG(1,("smb_signing_check_pdu: Can't check signature "
                                  "on short packet! smb_len = %u\n",
-                                 smb_len(inbuf)));
-                        return false;
-                }
-
-                status = NT_STATUS(IVAL(inbuf, smb_ss_field + 4));
+                                 (unsigned)len));
+                        return false;
+                }
+
+                status = NT_STATUS(IVAL(inhdr, HDR_SS_FIELD + 4));
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(1,("smb_signing_check_pdu: trusted channel passed %s\n",
@@ -55 +62 @@
                 }
 
-                *seqnum = IVAL(inbuf, smb_ss_field);
+                *seqnum = IVAL(inhdr, HDR_SS_FIELD);
                 return true;
         }
@@ -61 +68 @@
         *seqnum = smb_signing_next_seqnum(conn->smb1.signing_state, false);
         return smb_signing_check_pdu(conn->smb1.signing_state,
-                                     (const uint8_t *)inbuf,
+                                     inhdr, len,
                                      *seqnum);
 }
@@ -69 +76 @@
 ************************************************************/
 
-void srv_calculate_sign_mac(struct smbd_server_connection *conn,
+void srv_calculate_sign_mac(struct smbXsrv_connection *conn,
                             char *outbuf, uint32_t seqnum)
 {
+        uint8_t *outhdr;
+        size_t len;
+
         /* Check if it's a non-session message. */
         if(CVAL(outbuf,0)) {
@@ -77 +87 @@
         }
 
-        smb_signing_sign_pdu(conn->smb1.signing_state, (uint8_t *)outbuf, seqnum);
+        len = smb_len(outbuf);
+        outhdr = (uint8_t *)outbuf + NBT_HDR_SIZE;
+
+        smb_signing_sign_pdu(conn->smb1.signing_state, outhdr, len, seqnum);
 }
 
@@ -84 +97 @@
  Called to indicate a oneway request
 ************************************************************/
-void srv_cancel_sign_response(struct smbd_server_connection *conn)
+void srv_cancel_sign_response(struct smbXsrv_connection *conn)
 {
         smb_signing_cancel_reply(conn->smb1.signing_state, true);
@@ -155 +168 @@
 ************************************************************/
 
-bool srv_init_signing(struct smbd_server_connection *conn)
+bool srv_init_signing(struct smbXsrv_connection *conn)
 {
         bool allowed = true;
+        bool desired;
         bool mandatory = false;
 
-        switch (lp_server_signing()) {
-        case Required:
-                mandatory = true;
-                break;
-        case Auto:
-                break;
-        case True:
-                break;
-        case False:
-                allowed = false;
-                break;
-        }
+        struct loadparm_context *lp_ctx = loadparm_init_s3(conn, loadparm_s3_helpers());
+        if (lp_ctx == NULL) {
+                DEBUG(10, ("loadparm_init_s3 failed\n"));
+                return false;
+        }
+
+        /*
+         * if the client and server allow signing,
+         * we desire to use it.
+         *
+         * This matches Windows behavior and is needed
+         * because not every client that requires signing
+         * sends FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED.
+         *
+         * Note that we'll always allow signing if the client
+         * does send FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED.
+         */
+
+        desired = lpcfg_server_signing_allowed(lp_ctx, &mandatory);
+        talloc_unlink(conn, lp_ctx);
 
         if (lp_async_smb_echo_handler()) {
@@ -177 +199 @@
 
                 /* setup the signing state in shared memory */
-                s = talloc_zero(smbd_event_context(), struct smbd_shm_signing);
+                s = talloc_zero(conn, struct smbd_shm_signing);
                 if (s == NULL) {
                         return false;
@@ -190 +212 @@
                 talloc_set_destructor(s, smbd_shm_signing_destructor);
                 conn->smb1.signing_state = smb_signing_init_ex(s,
-                                                        allowed, mandatory,
+                                                        allowed, desired, mandatory,
                                                         smbd_shm_signing_alloc,
                                                         smbd_shm_signing_free);
@@ -199 +221 @@
         }
 
-        conn->smb1.signing_state = smb_signing_init(smbd_event_context(),
-                                                    allowed, mandatory);
+        conn->smb1.signing_state = smb_signing_init(conn,
+                                                    allowed, desired, mandatory);
         if (!conn->smb1.signing_state) {
                 return false;
@@ -208 +230 @@
 }
 
-void srv_set_signing_negotiated(struct smbd_server_connection *conn)
-{
-        smb_signing_set_negotiated(conn->smb1.signing_state);
+void srv_set_signing_negotiated(struct smbXsrv_connection *conn,
+                                bool allowed, bool mandatory)
+{
+        smb_signing_set_negotiated(conn->smb1.signing_state,
+                                   allowed, mandatory);
 }
 
@@ -218 +242 @@
 ************************************************************/
 
-bool srv_is_signing_active(struct smbd_server_connection *conn)
+bool srv_is_signing_active(struct smbXsrv_connection *conn)
 {
         return smb_signing_is_active(conn->smb1.signing_state);
@@ -229 +253 @@
 ************************************************************/
 
-bool srv_is_signing_negotiated(struct smbd_server_connection *conn)
+bool srv_is_signing_negotiated(struct smbXsrv_connection *conn)
 {
         return smb_signing_is_negotiated(conn->smb1.signing_state);
@@ -238 +262 @@
 ************************************************************/
 
-void srv_set_signing(struct smbd_server_connection *conn,
+void srv_set_signing(struct smbXsrv_connection *conn,
                      const DATA_BLOB user_session_key,
                      const DATA_BLOB response)