smbXcli: add support for smb2 signing

metze

1 files changed, 144 insertions, 5 deletions

diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index 2cb5d449d9..e2ff017465 100644
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -139,6 +139,7 @@ struct smbXcli_session {
 struct smbXcli_req_state {
 	struct tevent_context *ev;
 	struct smbXcli_conn *conn;
+	struct smbXcli_session *session; /* maybe NULL */
 
 	uint8_t length_hdr[4];
 
@@ -188,6 +189,8 @@ struct smbXcli_req_state {
 		struct iovec *recv_iov;
 
 		uint16_t credit_charge;
+
+		bool signing_skipped;
 	} smb2;
 };
 
@@ -2101,6 +2104,7 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
 	nbt_len = 0;
 
 	for (i=0; i<num_reqs; i++) {
+		int hdr_iov;
 		size_t reqlen;
 		bool ret;
 		uint64_t avail;
@@ -2160,6 +2164,7 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
 		SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
 		SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
 
+		hdr_iov = num_iov;
 		iov[num_iov].iov_base = state->smb2.hdr;
 		iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
 		num_iov += 1;
@@ -2190,16 +2195,22 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
 		}
 		nbt_len += reqlen;
 
+		if (state->session && state->session->smb2.should_sign) {
+			NTSTATUS status;
+
+			status = smb2_signing_sign_pdu(state->session->smb2.signing_key,
+						       &iov[hdr_iov], num_iov - hdr_iov);
+			if (!NT_STATUS_IS_OK(status)) {
+				return status;
+			}
+		}
+
 		ret = smbXcli_req_set_pending(reqs[i]);
 		if (!ret) {
 			return NT_STATUS_NO_MEMORY;
 		}
 	}
 
-	/*
-	 * TODO: Do signing here
-	 */
-
 	state = tevent_req_data(reqs[0], struct smbXcli_req_state);
 	_smb_setlen_tcp(state->length_hdr, nbt_len);
 	iov[0].iov_base = state->length_hdr;
@@ -2413,6 +2424,7 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
 	int i, num_iov;
 	NTSTATUS status;
 	bool defer = true;
+	struct smbXcli_session *last_session = NULL;
 
 	status = smb2cli_inbuf_parse_compound(inbuf, tmp_mem,
 					      &iov, &num_iov);
@@ -2428,8 +2440,11 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
 		uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
 		uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 		uint16_t req_opcode;
+		uint32_t req_flags;
 		uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
 		uint32_t new_credits;
+		struct smbXcli_session *session = NULL;
+		const DATA_BLOB *signing_key = NULL;
 
 		new_credits = conn->smb2.cur_credits;
 		new_credits += credits;
@@ -2448,6 +2463,7 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
 		if (opcode != req_opcode) {
 			return NT_STATUS_INVALID_NETWORK_RESPONSE;
 		}
+		req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
 
 		if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
 			return NT_STATUS_INVALID_NETWORK_RESPONSE;
@@ -2456,15 +2472,129 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
 		status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
 		if ((flags & SMB2_HDR_FLAG_ASYNC) &&
 		    NT_STATUS_EQUAL(status, STATUS_PENDING)) {
-			uint32_t req_flags = IVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
 			uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
 
+			/*
+			 * async interim responses are not signed,
+			 * even if the SMB2_HDR_FLAG_SIGNED flag
+			 * is set.
+			 */
 			req_flags |= SMB2_HDR_FLAG_ASYNC;
 			SBVAL(state->smb2.hdr, SMB2_HDR_FLAGS, req_flags);
 			SBVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID, async_id);
 			continue;
 		}
 
+		session = state->session;
+		if (req_flags & SMB2_HDR_FLAG_CHAINED) {
+			session = last_session;
+		}
+		last_session = session;
+
+		if (session && session->smb2.should_sign) {
+			if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
+				return NT_STATUS_ACCESS_DENIED;
+			}
+		}
+
+		if (flags & SMB2_HDR_FLAG_SIGNED) {
+			uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
+
+			if (session == NULL) {
+				struct smbXcli_session *s;
+
+				s = state->conn->sessions;
+				for (; s; s = s->next) {
+					if (s->smb2.session_id != uid) {
+						continue;
+					}
+
+					session = s;
+					break;
+				}
+			}
+
+			if (session == NULL) {
+				return NT_STATUS_INVALID_NETWORK_RESPONSE;
+			}
+
+			last_session = session;
+			signing_key = &session->smb2.signing_key;
+		}
+
+		if ((opcode == SMB2_OP_SESSSETUP) &&
+		     NT_STATUS_IS_OK(status)) {
+			/*
+			 * the caller has to check the signing
+			 * as only the caller knows the correct
+			 * session key
+			 */
+			signing_key = NULL;
+		}
+
+		if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
+			/*
+			 * if the server returns NT_STATUS_USER_SESSION_DELETED
+			 * the response is not signed and we should
+			 * propagate the NT_STATUS_USER_SESSION_DELETED
+			 * status to the caller.
+			 */
+			if (signing_key) {
+				signing_key = NULL;
+			}
+		}
+
+		if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
+		    NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
+		    NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
+			/*
+			 * if the server returns
+			 * NT_STATUS_NETWORK_NAME_DELETED
+			 * NT_STATUS_FILE_CLOSED
+			 * NT_STATUS_INVALID_PARAMETER
+			 * the response might not be signed
+			 * as this happens before the signing checks.
+			 *
+			 * If server echos the signature (or all zeros)
+			 * we should report the status from the server
+			 * to the caller.
+			 */
+			if (signing_key) {
+				int cmp;
+
+				cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
+					     state->smb2.hdr+SMB2_HDR_SIGNATURE,
+					     16);
+				if (cmp == 0) {
+					state->smb2.signing_skipped = true;
+					signing_key = NULL;
+				}
+			}
+			if (signing_key) {
+				int cmp;
+				static const uint8_t zeros[16];
+
+				cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
+					     zeros,
+					     16);
+				if (cmp == 0) {
+					state->smb2.signing_skipped = true;
+					signing_key = NULL;
+				}
+			}
+		}
+
+		if (signing_key) {
+			status = smb2_signing_check_pdu(*signing_key, cur, 3);
+			if (!NT_STATUS_IS_OK(status)) {
+				/*
+				 * If the signing check fails, we disconnect
+				 * the connection.
+				 */
+				return status;
+			}
+		}
+
 		smbXcli_req_unset_pending(req);
 
 		/*
@@ -2565,6 +2695,15 @@ NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 		return status;
 	}
 
+	if (state->smb2.signing_skipped) {
+		if (num_expected > 0) {
+			return NT_STATUS_ACCESS_DENIED;
+		}
+		if (!NT_STATUS_IS_ERR(status)) {
+			return NT_STATUS_ACCESS_DENIED;
+		}
+	}
+
 	if (!found_size) {
 		return NT_STATUS_INVALID_NETWORK_RESPONSE;
 	}