More fixes for client and server side signing. Ensure sequence numbers

are updated correctly on returning an error for server trans streams.
Ensure we turn off client trans streams on error.
Jeremy.
(This used to be commit 3a789cb7f01115c37404e5a696de363287cb0e5f)

1 files changed, 42 insertions, 15 deletions

diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c
index 5fc44eb953..a62b5a4cdf 100644
--- a/source3/libsmb/smb_signing.c
+++ b/source3/libsmb/smb_signing.c
@@ -186,9 +186,6 @@ static void free_signing_context(struct smb_sign_info *si)
 
 static BOOL signing_good(char *inbuf, struct smb_sign_info *si, BOOL good) 
 {
-	DEBUG(10, ("signing_good: got SMB signature of\n"));
-	dump_data(10,&inbuf[smb_ss_field] , 8);
-
 	if (good && !si->doing_signing) {
 		si->doing_signing = True;
 	}
@@ -199,11 +196,11 @@ static BOOL signing_good(char *inbuf, struct smb_sign_info *si, BOOL good)
 
 			/* W2K sends a bad first signature but the sign engine is on.... JRA. */
 			if (data->send_seq_num > 1)
-				DEBUG(1, ("SMB signature check failed!\n"));
+				DEBUG(1, ("signing_good: SMB signature check failed!\n"));
 
 			return False;
 		} else {
-			DEBUG(3, ("Server did not sign reply correctly\n"));
+			DEBUG(3, ("signing_good: Peer did not sign reply correctly\n"));
 			free_signing_context(si);
 			return False;
 		}
@@ -366,6 +363,9 @@ static BOOL client_check_incoming_message(char *inbuf, struct smb_sign_info *si)
 		}
 #endif /* JRATEST */
 
+	} else {
+		DEBUG(10, ("client_check_incoming_message:: seq %u: got good SMB signature of\n", (unsigned int)reply_seq_number));
+		dump_data(10, server_sent_mac, 8);
 	}
 	return signing_good(inbuf, si, good);
 }
@@ -455,7 +455,7 @@ void cli_signing_trans_start(struct cli_state *cli)
 {
 	struct smb_basic_signing_context *data = cli->sign_info.signing_context;
 
-	if (!cli->sign_info.doing_signing)
+	if (!cli->sign_info.doing_signing || !data)
 		return;
 
 	data->trans_info = smb_xmalloc(sizeof(struct trans_info_context));
@@ -464,6 +464,13 @@ void cli_signing_trans_start(struct cli_state *cli)
 	data->trans_info->send_seq_num = data->send_seq_num;
 	data->trans_info->mid = SVAL(cli->outbuf,smb_mid);
 	data->trans_info->reply_seq_num = data->send_seq_num+1;
+
+	DEBUG(10,("cli_signing_trans_start: storing mid = %u, reply_seq_num = %u, send_seq_num = %u \
+data->send_seq_num = %u\n",
+			(unsigned int)data->trans_info->mid,
+			(unsigned int)data->trans_info->reply_seq_num,
+			(unsigned int)data->trans_info->send_seq_num,
+			(unsigned int)data->send_seq_num ));
 }
 
 /***********************************************************
@@ -474,7 +481,7 @@ void cli_signing_trans_stop(struct cli_state *cli)
 {
 	struct smb_basic_signing_context *data = cli->sign_info.signing_context;
 
-	if (!cli->sign_info.doing_signing)
+	if (!cli->sign_info.doing_signing || !data)
 		return;
 
 	SAFE_FREE(data->trans_info);
@@ -638,12 +645,15 @@ static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si)
 	/* See if this is a reply for a deferred packet. */
 	was_deferred_packet = get_sequence_for_reply(&data->outstanding_packet_list, mid, &send_seq_number);
 
-	if (data->trans_info && (data->trans_info->mid == mid))
+	if (data->trans_info && (data->trans_info->mid == mid)) {
+		/* This is a reply in a trans stream. Use the sequence
+		 * number associated with the stream mid. */
 		send_seq_number = data->trans_info->send_seq_num;
+	}
 
 	simple_packet_signature(data, outbuf, send_seq_number, calc_md5_mac);
 
-	DEBUG(10, ("srv_sign_outgoing_message: sent SMB signature of\n"));
+	DEBUG(10, ("srv_sign_outgoing_message: seq %u: sent SMB signature of\n", (unsigned int)send_seq_number));
 	dump_data(10, calc_md5_mac, 8);
 
 	memcpy(&outbuf[smb_ss_field], calc_md5_mac, 8);
@@ -651,8 +661,16 @@ static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si)
 /*	cli->outbuf[smb_ss_field+2]=0; 
 	Uncomment this to test if the remote server actually verifies signatures...*/
 
-	if (!was_deferred_packet && !data->trans_info)
-		data->send_seq_num++;
+	if (!was_deferred_packet) {
+	       	if (!data->trans_info) {
+			/* Always increment if not in a trans stream. */
+			data->send_seq_num++;
+		} else if ((data->trans_info->send_seq_num == data->send_seq_num) || (data->trans_info->mid != mid)) {
+			/* Increment if this is the first reply in a trans stream or a
+			 * packet that doesn't belong to this stream (different mid). */
+			data->send_seq_num++;
+		}
+	}
 }
 
 /***********************************************************
@@ -717,6 +735,9 @@ static BOOL srv_check_incoming_message(char *inbuf, struct smb_sign_info *si)
 		}
 #endif /* JRATEST */
 
+	} else {
+		DEBUG(10, ("srv_check_incoming_message: seq %u: got good SMB signature of\n", (unsigned int)reply_seq_number));
+		dump_data(10, server_sent_mac, 8);
 	}
 	return signing_good(inbuf, si, good);
 }
@@ -830,6 +851,8 @@ void srv_signing_trans_start(uint16 mid)
 		return;
 
 	data = (struct smb_basic_signing_context *)srv_sign_info.signing_context;
+	if (!data)
+		return;
 
 	data->trans_info = smb_xmalloc(sizeof(struct trans_info_context));
 	ZERO_STRUCTP(data->trans_info);
@@ -838,9 +861,12 @@ void srv_signing_trans_start(uint16 mid)
 	data->trans_info->mid = mid;
 	data->trans_info->send_seq_num = data->send_seq_num;
 
-	/* Increment now in case we need to send a non-trans
-	 * reply in the middle of the trans stream. */
-	data->send_seq_num++;
+	DEBUG(10,("srv_signing_trans_start: storing mid = %u, reply_seq_num = %u, send_seq_num = %u \
+data->send_seq_num = %u\n",
+			(unsigned int)mid,
+			(unsigned int)data->trans_info->reply_seq_num,
+			(unsigned int)data->trans_info->send_seq_num,
+			(unsigned int)data->send_seq_num ));
 }
 
 /***********************************************************
@@ -855,12 +881,13 @@ void srv_signing_trans_stop(void)
 		return;
 
 	data = (struct smb_basic_signing_context *)srv_sign_info.signing_context;
+	if (!data || !data->trans_info)
+		return;
 
 	SAFE_FREE(data->trans_info);
 	data->trans_info = NULL;
 }
 
-
 /***********************************************************
  Turn on signing from this packet onwards. 
 ************************************************************/