diff options
| author | Jeremy Allison <jra@samba.org> | 2003-07-15 23:05:57 +0000 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2003-07-15 23:05:57 +0000 |
| commit | c44a9d25a2bfff9d5ebede80f30e13e41aca797c (patch) | |
| tree | 11dcb00a982f123ea0dd60bafe3e064a7e51d371 /source3/libsmb | |
| parent | 39de3249b0676a65cfbce23484d964f1e3334baa (diff) | |
| download | samba-c44a9d25a2bfff9d5ebede80f30e13e41aca797c.tar.gz samba-c44a9d25a2bfff9d5ebede80f30e13e41aca797c.tar.bz2 samba-c44a9d25a2bfff9d5ebede80f30e13e41aca797c.zip | |
Added the "required" keyword to the "client signing" parameter to force it
on. Fail if missmatch. Small format tidyups in smbd/sesssetup.c. Preparing
to add signing on server side.
Jeremy.
(This used to be commit c390b3e4cd68cfc233ddf14d139e25d40f050f27)
Diffstat (limited to 'source3/libsmb')
| -rw-r--r-- | source3/libsmb/cliconnect.c | 16 | ||||
| -rw-r--r-- | source3/libsmb/clientgen.c | 3 | ||||
| -rw-r--r-- | source3/libsmb/smb_signing.c | 5 |
3 files changed, 19 insertions, 5 deletions
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index 8c02c4fdfe..fa9af19bf5 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -541,7 +541,7 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, ntlmssp_state->use_ntlmv2 = lp_client_ntlmv2_auth(); if (cli->sign_info.negotiated_smb_signing - || cli->sign_info.mandetory_signing) { + || cli->sign_info.mandatory_signing) { ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN; ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN; } @@ -1013,12 +1013,24 @@ BOOL cli_negprot(struct cli_state *cli) smb_buflen(cli->inbuf)-8, STR_UNICODE|STR_NOALIGN); } - if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)) + if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)) { + /* Fail if signing is mandatory and we don't want to support it. */ + if (!lp_client_signing()) { + DEBUG(1,("cli_negprot: SMB signing is mandatory and we have disabled it.\n")); + return False; + } cli->sign_info.negotiated_smb_signing = True; + } if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) && cli->sign_info.allow_smb_signing) cli->sign_info.negotiated_smb_signing = True; + /* Fail if signing is mandatory and the server doesn't support it. */ + if (cli->sign_info.mandatory_signing && !(cli->sign_info.negotiated_smb_signing)) { + DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n")); + return False; + } + } else if (cli->protocol >= PROTOCOL_LANMAN1) { cli->use_spnego = False; cli->sec_mode = SVAL(cli->inbuf,smb_vwv1); diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c index 93fa94c1db..58c5ad8cd3 100644 --- a/source3/libsmb/clientgen.c +++ b/source3/libsmb/clientgen.c @@ -261,6 +261,9 @@ struct cli_state *cli_initialise(struct cli_state *cli) if (lp_client_signing()) cli->sign_info.allow_smb_signing = True; + + if (lp_client_signing() == Required) + cli->sign_info.mandatory_signing = True; if (!cli->outbuf || !cli->inbuf) goto error; diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c index 466f32cb92..d4f77bf07c 100644 --- a/source3/libsmb/smb_signing.c +++ b/source3/libsmb/smb_signing.c @@ -72,7 +72,7 @@ static BOOL get_sequence_for_reply(struct outstanding_packet_lookup **list, static BOOL cli_set_smb_signing_common(struct cli_state *cli) { if (!cli->sign_info.negotiated_smb_signing - && !cli->sign_info.mandetory_signing) { + && !cli->sign_info.mandatory_signing) { return False; } @@ -96,7 +96,7 @@ static BOOL cli_set_smb_signing_common(struct cli_state *cli) static BOOL cli_set_smb_signing_real_common(struct cli_state *cli) { - if (cli->sign_info.mandetory_signing) { + if (cli->sign_info.mandatory_signing) { DEBUG(5, ("Mandatory SMB signing enabled!\n")); cli->sign_info.doing_signing = True; } @@ -458,4 +458,3 @@ BOOL cli_check_sign_mac(struct cli_state *cli) return True; } - |