Fix up some of the SMB signing code:

The problem was that *all* packets were being signed, even packets before
signing was set up.  (This broke the session request).

This fixes it to be an 'opt in' measure - that is, we only attempt to sign
things after we have got a valid, non-guest session setup as per the CIFS spec.

I've not tested this against an MS server, becouse my VMware is down, but
at least it doesn't break the build farm any more.

Andrew Bartlett
(This used to be commit 1dc5a8765876c1ca822e454651f8fd4a551965e9)

1 files changed, 24 insertions, 17 deletions

diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 33e2b28609..135238b9a7 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -144,9 +144,6 @@ static BOOL cli_session_setup_guest(struct cli_state *cli)
 	char *p;
 	uint32 capabilities = cli_session_setup_capabilities(cli);
 
-	/* Guest cannot use SMB signing. */
-	cli->sign_info.use_smb_signing = False;
-
 	set_message(cli->outbuf,13,0,True);
 	SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 	cli_setup_packet(cli);
@@ -202,9 +199,6 @@ static BOOL cli_session_setup_plaintext(struct cli_state *cli, char *user,
 
 	passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE|STR_ASCII);
 
-	/* Plaintext password cannot use SMB signing. */
-	cli->sign_info.use_smb_signing = False;
-
 	set_message(cli->outbuf,13,0,True);
 	SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 	cli_setup_packet(cli);
@@ -275,12 +269,15 @@ static BOOL cli_session_setup_nt1(struct cli_state *cli, char *user,
 		ntpasslen = 24;
 		SMBencrypt((uchar *)pass,cli->secblob.data,(uchar *)pword);
 		SMBNTencrypt((uchar *)pass,cli->secblob.data,(uchar *)ntpword);
-		cli_calculate_mac_key(cli, (uchar *)pass, (uchar *)ntpword);
 	} else {
 		memcpy(pword, pass, passlen);
 		memcpy(ntpword, ntpass, ntpasslen);
 	}
 
+	if (cli->sign_info.negotiated_smb_signing) {
+		cli_calculate_mac_key(cli, (uchar *)pass, (uchar *)ntpword);
+	}
+
 	/* send a session setup command */
 	memset(cli->outbuf,'\0',smb_size);
 
@@ -311,10 +308,15 @@ static BOOL cli_session_setup_nt1(struct cli_state *cli, char *user,
 
 	show_msg(cli->inbuf);
 
+	if (cli_is_error(cli) || SVAL(cli->inbuf,smb_vwv2) /* guest */) {
+		/* We only use it if we have a successful non-guest connect */
+		cli->sign_info.use_smb_signing = False;
+	}
+
 	if (cli_is_error(cli)) {
 		return False;
 	}
-	
+
 	/* use the returned vuid from now on */
 	cli->vuid = SVAL(cli->inbuf,smb_uid);
 	
@@ -346,9 +348,6 @@ static DATA_BLOB cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 	/* send a session setup command */
 	memset(cli->outbuf,'\0',smb_size);
 
-	/* Extended security cannot use SMB signing (for now). */
-	cli->sign_info.use_smb_signing = False;
-
 	set_message(cli->outbuf,12,0,True);
 	SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 	cli_setup_packet(cli);
@@ -813,6 +812,11 @@ BOOL cli_negprot(struct cli_state *cli)
 	int numprots;
 	int plength;
 
+	if (cli->sign_info.use_smb_signing) {
+		DEBUG(0, ("Cannot send negprot again, particularly after setting up SMB Signing\n"));
+		return False;
+	}
+
 	if (cli->protocol < PROTOCOL_NT1) {
 		cli->use_spnego = False;
 	}
@@ -879,10 +883,10 @@ BOOL cli_negprot(struct cli_state *cli)
 
 		/* A way to attempt to force SMB signing */
 		if (getenv("CLI_FORCE_SMB_SIGNING"))
-			cli->sign_info.use_smb_signing = True;
-
-		if (cli->sign_info.use_smb_signing && !(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED))
-			cli->sign_info.use_smb_signing = False;
+			cli->sign_info.negotiated_smb_signing = True;
+                                   
+		if (cli->sign_info.negotiated_smb_signing && !(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED))
+			cli->sign_info.negotiated_smb_signing = False;
 
 	} else if (cli->protocol >= PROTOCOL_LANMAN1) {
 		cli->use_spnego = False;
@@ -896,13 +900,11 @@ BOOL cli_negprot(struct cli_state *cli)
 		cli->readbraw_supported = ((SVAL(cli->inbuf,smb_vwv5) & 0x1) != 0);
 		cli->writebraw_supported = ((SVAL(cli->inbuf,smb_vwv5) & 0x2) != 0);
 		cli->secblob = data_blob(smb_buf(cli->inbuf),smb_buflen(cli->inbuf));
-		cli->sign_info.use_smb_signing = False;
 	} else {
 		/* the old core protocol */
 		cli->use_spnego = False;
 		cli->sec_mode = 0;
 		cli->serverzone = TimeDiff(time(NULL));
-		cli->sign_info.use_smb_signing = False;
 	}
 
 	cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
@@ -929,6 +931,11 @@ BOOL cli_session_request(struct cli_state *cli,
 	/* 445 doesn't have session request */
 	if (cli->port == 445) return True;
 
+	if (cli->sign_info.use_smb_signing) {
+		DEBUG(0, ("Cannot send session resquest again, particularly after setting up SMB Signing\n"));
+		return False;
+	}
+
 	/* send a session request (RFC 1002) */
 	memcpy(&(cli->calling), calling, sizeof(*calling));
 	memcpy(&(cli->called ), called , sizeof(*called ));