Add the capability to set "smb encrypt = required"

on a share (or global) and have the server reply with
ACCESS_DENIED for all non-encrypted traffic (except
that used to query encryption requirements and set
encryption state).
Jeremy.
(This used to be commit d241bfa57729bb934ada6beabf842a2ca7b4f8a2)

1 files changed, 15 insertions, 2 deletions

diff --git a/source3/client/client.c b/source3/client/client.c
index 665a051190..53669bc8d0 100644
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -2466,17 +2466,30 @@ static int cmd_posix(void)
 			return 1;
 		}
 	}
+	if (caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP) {
+		caps = talloc_asprintf_append(caps, "posix_encrypt ");
+		if (!caps) {
+			return 1;
+		}
+	}
+	if (caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP) {
+		caps = talloc_asprintf_append(caps, "mandatory_posix_encrypt ");
+		if (!caps) {
+			return 1;
+		}
+	}
 
 	if (*caps && caps[strlen(caps)-1] == ' ') {
 		caps[strlen(caps)-1] = '\0';
 	}
+
+	d_printf("Server supports CIFS capabilities %s\n", caps);
+
 	if (!cli_set_unix_extensions_capabilities(cli, major, minor, caplow, caphigh)) {
 		d_printf("Can't set UNIX CIFS extensions capabilities. %s.\n", cli_errstr(cli));
 		return 1;
 	}
 
-	d_printf("Selecting server supported CIFS capabilities %s\n", caps);
-
 	if (caplow & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
 		CLI_DIRSEP_CHAR = '/';
 		*CLI_DIRSEP_STR = '/';