summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2008-05-13 15:19:46 +0200
committerVolker Lendecke <vl@samba.org>2008-05-13 16:29:47 +0200
commit8ef2ada0ef36f946c79e5523db90f8d1d03d6607 (patch)
treefad013bae19c17a0c0bbc1f6582f25778123d6eb
parent5d6528e44fc49924b99ac9b49db298d5fa6ac920 (diff)
downloadsamba-8ef2ada0ef36f946c79e5523db90f8d1d03d6607.tar.gz
samba-8ef2ada0ef36f946c79e5523db90f8d1d03d6607.tar.bz2
samba-8ef2ada0ef36f946c79e5523db90f8d1d03d6607.zip
Revert "Fix signing bug found by Volker. That one was *subtle*."
This reverts commit 816aea6c1a426eb2450061b847729e22bdac33a0. (This used to be commit e402e6508ca0806deef4c4044cfa6461b682850a)
-rw-r--r--source3/libsmb/clitrans.c14
-rw-r--r--source3/libsmb/smb_signing.c79
2 files changed, 88 insertions, 5 deletions
diff --git a/source3/libsmb/clitrans.c b/source3/libsmb/clitrans.c
index bfb31fdb74..aa9c2fb296 100644
--- a/source3/libsmb/clitrans.c
+++ b/source3/libsmb/clitrans.c
@@ -94,9 +94,14 @@ bool cli_send_trans(struct cli_state *cli, int trans,
return False;
}
+ /* Note we're in a trans state. Save the sequence
+ * numbers for replies. */
+ client_set_trans_sign_state_on(cli, mid);
+
if (this_ldata < ldata || this_lparam < lparam) {
/* receive interim response */
if (!cli_receive_smb(cli) || cli_is_error(cli)) {
+ client_set_trans_sign_state_off(cli, mid);
return(False);
}
@@ -138,6 +143,7 @@ bool cli_send_trans(struct cli_state *cli, int trans,
show_msg(cli->outbuf);
if (!cli_send_smb(cli)) {
+ client_set_trans_sign_state_off(cli, mid);
return False;
}
@@ -344,6 +350,7 @@ bool cli_receive_trans(struct cli_state *cli,int trans,
}
}
+ client_set_trans_sign_state_off(cli, SVAL(cli->inbuf,smb_mid));
return ret;
}
@@ -411,9 +418,14 @@ bool cli_send_nt_trans(struct cli_state *cli,
return False;
}
+ /* Note we're in a trans state. Save the sequence
+ * numbers for replies. */
+ client_set_trans_sign_state_on(cli, mid);
+
if (this_ldata < ldata || this_lparam < lparam) {
/* receive interim response */
if (!cli_receive_smb(cli) || cli_is_error(cli)) {
+ client_set_trans_sign_state_off(cli, mid);
return(False);
}
@@ -455,6 +467,7 @@ bool cli_send_nt_trans(struct cli_state *cli,
show_msg(cli->outbuf);
if (!cli_send_smb(cli)) {
+ client_set_trans_sign_state_off(cli, mid);
return False;
}
@@ -682,5 +695,6 @@ bool cli_receive_nt_trans(struct cli_state *cli,
}
}
+ client_set_trans_sign_state_off(cli, SVAL(cli->inbuf,smb_mid));
return ret;
}
diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c
index bd6d97123d..ea1eb05cfb 100644
--- a/source3/libsmb/smb_signing.c
+++ b/source3/libsmb/smb_signing.c
@@ -25,6 +25,7 @@ struct outstanding_packet_lookup {
struct outstanding_packet_lookup *prev, *next;
uint16 mid;
uint32 reply_seq_num;
+ bool can_delete; /* Set to False in trans state. */
};
struct smb_basic_signing_context {
@@ -41,9 +42,7 @@ static bool store_sequence_for_reply(struct outstanding_packet_lookup **list,
/* Ensure we only add a mid once. */
for (t = *list; t; t = t->next) {
if (t->mid == mid) {
- DLIST_REMOVE(*list, t);
- SAFE_FREE(t);
- break;
+ return False;
}
}
@@ -52,6 +51,7 @@ static bool store_sequence_for_reply(struct outstanding_packet_lookup **list,
t->mid = mid;
t->reply_seq_num = reply_seq_num;
+ t->can_delete = True;
/*
* Add to the *start* of the list not the end of the list.
@@ -78,8 +78,23 @@ static bool get_sequence_for_reply(struct outstanding_packet_lookup **list,
*reply_seq_num = t->reply_seq_num;
DEBUG(10,("get_sequence_for_reply: found seq = %u mid = %u\n",
(unsigned int)t->reply_seq_num, (unsigned int)t->mid ));
- DLIST_REMOVE(*list, t);
- SAFE_FREE(t);
+ if (t->can_delete) {
+ DLIST_REMOVE(*list, t);
+ SAFE_FREE(t);
+ }
+ return True;
+ }
+ }
+ return False;
+}
+
+static bool set_sequence_can_delete_flag(struct outstanding_packet_lookup **list, uint16 mid, bool can_delete_entry)
+{
+ struct outstanding_packet_lookup *t;
+
+ for (t = *list; t; t = t->next) {
+ if (t->mid == mid) {
+ t->can_delete = can_delete_entry;
return True;
}
}
@@ -594,6 +609,60 @@ bool cli_check_sign_mac(struct cli_state *cli, char *buf)
}
/***********************************************************
+ Enter trans/trans2/nttrans state.
+************************************************************/
+
+bool client_set_trans_sign_state_on(struct cli_state *cli, uint16 mid)
+{
+ struct smb_sign_info *si = &cli->sign_info;
+ struct smb_basic_signing_context *data = (struct smb_basic_signing_context *)si->signing_context;
+
+ if (!si->doing_signing) {
+ return True;
+ }
+
+ if (!data) {
+ return False;
+ }
+
+ if (!set_sequence_can_delete_flag(&data->outstanding_packet_list, mid, False)) {
+ return False;
+ }
+
+ return True;
+}
+
+/***********************************************************
+ Leave trans/trans2/nttrans state.
+************************************************************/
+
+bool client_set_trans_sign_state_off(struct cli_state *cli, uint16 mid)
+{
+ uint32 reply_seq_num;
+ struct smb_sign_info *si = &cli->sign_info;
+ struct smb_basic_signing_context *data = (struct smb_basic_signing_context *)si->signing_context;
+
+ if (!si->doing_signing) {
+ return True;
+ }
+
+ if (!data) {
+ return False;
+ }
+
+ if (!set_sequence_can_delete_flag(&data->outstanding_packet_list, mid, True)) {
+ return False;
+ }
+
+ /* Now delete the stored mid entry. */
+ if (!get_sequence_for_reply(&data->outstanding_packet_list, mid, &reply_seq_num)) {
+ return False;
+ }
+
+ return True;
+}
+
+/***********************************************************
Is client signing on ?
************************************************************/