r1796: Enable server-side SPNEGO, now that I have fixed the server-side SMB

signing code to be able to cope.

Andrew Bartlett
(This used to be commit cb74d52b563730a50e33c92d868c45ee96a598e8)

6 files changed, 152 insertions, 64 deletions

diff --git a/source4/smb_server/negprot.c b/source4/smb_server/negprot.c
index 9e8a8f1f2c..d81900107b 100644
--- a/source4/smb_server/negprot.c
+++ b/source4/smb_server/negprot.c
@@ -57,6 +57,11 @@ static void reply_corep(struct smbsrv_request *req, uint16_t choice)
 
 	req->smb_conn->negotiate.protocol = PROTOCOL_CORE;
 
+	if (req->smb_conn->signing.mandatory_signing) {
+		smbsrv_terminate_connection(req->smb_conn, 
+					    "CORE does not support SMB signing, and it is mandetory\n");
+	}
+
 	req_send_reply(req);
 }
 
@@ -84,6 +89,11 @@ static void reply_coreplus(struct smbsrv_request *req, uint16_t choice)
 
 	req->smb_conn->negotiate.protocol = PROTOCOL_COREPLUS;
 
+	if (req->smb_conn->signing.mandatory_signing) {
+		smbsrv_terminate_connection(req->smb_conn, 
+					    "COREPLUS does not support SMB signing, and it is mandetory\n");
+	}
+
 	req_send_reply(req);
 }
 
@@ -128,6 +138,11 @@ static void reply_lanman1(struct smbsrv_request *req, uint16_t choice)
 		get_challenge(req->smb_conn, req->out.data);
 	}
 
+	if (req->smb_conn->signing.mandatory_signing) {
+		smbsrv_terminate_connection(req->smb_conn, 
+					    "LANMAN1 does not support SMB signing, and it is mandetory\n");
+	}
+
 	req_send_reply(req);	
 }
 
@@ -171,6 +186,10 @@ static void reply_lanman2(struct smbsrv_request *req, uint16_t choice)
 
 	req_push_str(req, NULL, lp_workgroup(), -1, STR_TERMINATE);
 
+	if (req->smb_conn->signing.mandatory_signing) {
+		smbsrv_terminate_connection(req->smb_conn, 
+					    "LANMAN2 does not support SMB signing, and it is mandetory\n");
+	}
 
 	req_send_reply(req);
 }
@@ -198,7 +217,7 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice)
 	/* do spnego in user level security if the client
 	   supports it and we can do encrypted passwords */
 	
-	if (0 && req->smb_conn->negotiate.encrypted_passwords && 
+	if (req->smb_conn->negotiate.encrypted_passwords && 
 	    (lp_security() != SEC_SHARE) &&
 	    lp_use_spnego() &&
 	    (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
@@ -241,18 +260,12 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice)
 		secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
 	}
 
-	req->smb_conn->signing.signing_state = lp_server_signing();
-
-	switch (req->smb_conn->signing.signing_state) {
-	case SMB_SIGNING_OFF:
-		break;
-	case SMB_SIGNING_SUPPORTED:
+	if (req->smb_conn->signing.allow_smb_signing) {
 		secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
-		break;
-	case SMB_SIGNING_REQUIRED:
-		secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED |
-			NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
-		break;
+	}
+
+	if (req->smb_conn->signing.mandatory_signing) {
+		secword |= NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
 	}
 	
 	req->smb_conn->negotiate.protocol = PROTOCOL_NT1;
diff --git a/source4/smb_server/request.c b/source4/smb_server/request.c
index f4cdba79cc..e9aeb168bc 100644
--- a/source4/smb_server/request.c
+++ b/source4/smb_server/request.c
@@ -263,7 +263,7 @@ void req_send_reply_nosign(struct smbsrv_request *req)
 	}
 
 	if (write_data(req->smb_conn->connection->socket->fde->fd, req->out.buffer, req->out.size) != req->out.size) {
-		smb_panic("failed to send reply\n");
+		smbsrv_terminate_connection(req->smb_conn, "failed to send reply\n");
 	}
 
 	req_destroy(req);
diff --git a/source4/smb_server/sesssetup.c b/source4/smb_server/sesssetup.c
index e1245748a0..a87db0ecc4 100644
--- a/source4/smb_server/sesssetup.c
+++ b/source4/smb_server/sesssetup.c
@@ -160,9 +160,18 @@ static NTSTATUS sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *s
 				 &sess->nt1.out.domain);
 	
 	req->session = smbsrv_session_find(req->smb_conn, sess->nt1.out.vuid);
-	if (!session_info->server_info->guest) {
-		srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2);
+	if (session_info->server_info->guest) {
+		return NT_STATUS_OK;
 	}
+	if (!srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2)) {
+		/* Already signing, or disabled */
+		return NT_STATUS_OK;
+	}
+		
+	/* Force check of the request packet, now we know the session key */
+	req_signing_check_incoming(req);
+
+	srv_signing_restart(req->smb_conn,  &session_info->session_key, &sess->nt1.in.password2);
 
 	return NT_STATUS_OK;
 }
@@ -227,7 +236,6 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup
 
 	if (NT_STATUS_IS_OK(status)) {
 		DATA_BLOB session_key;
-		DATA_BLOB null_data_blob = data_blob(NULL, 0);
 		
 		status = gensec_session_info(smb_sess->gensec_ctx, &smb_sess->session_info);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -235,12 +243,18 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup
 		}
 		
 		status = gensec_session_key(smb_sess->gensec_ctx, 
-						       &session_key);
-		if (NT_STATUS_IS_OK(status)) {
-			srv_setup_signing(req->smb_conn, &session_key, &null_data_blob);
-			req->seq_num = 0;
-			req->smb_conn->signing.next_seq_num = 2;
+					    &session_key);
+		if (NT_STATUS_IS_OK(status) 
+		    && !smb_sess->session_info->server_info->guest
+		    && srv_setup_signing(req->smb_conn, &session_key, NULL)) {
+			/* Force check of the request packet, now we know the session key */
+			req_signing_check_incoming(req);
+
+			srv_signing_restart(req->smb_conn, &session_key, NULL);
+
 		}
+	} else {
+		status = nt_status_squash(status);
 	}
 
 	sess->spnego.out.action = 0;
diff --git a/source4/smb_server/signing.c b/source4/smb_server/signing.c
index 37c1f6f7b1..555a71c0a9 100644
--- a/source4/smb_server/signing.c
+++ b/source4/smb_server/signing.c
@@ -25,34 +25,93 @@
 */
 void req_sign_packet(struct smbsrv_request *req)
 {
-	/* check if we are doing signing on this connection */
-	if (req->smb_conn->signing.signing_state != SMB_SIGNING_REQUIRED) {
-		return;
+#if 0
+	/* enable this when packet signing is preventing you working out why valgrind 
+	   says that data is uninitialised */
+	file_save("pkt.dat", req->out.buffer, req->out.size);
+#endif
+
+	switch (req->smb_conn->signing.signing_state) {
+	case SMB_SIGNING_ENGINE_OFF:
+		break;
+
+	case SMB_SIGNING_ENGINE_BSRSPYL:
+		/* mark the packet as signed - BEFORE we sign it...*/
+		mark_packet_signed(&req->out);
+		
+		/* I wonder what BSRSPYL stands for - but this is what MS 
+		   actually sends! */
+		memcpy((req->out.hdr + HDR_SS_FIELD), "BSRSPYL ", 8);
+		break;
+
+	case SMB_SIGNING_ENGINE_ON:
+			
+		sign_outgoing_message(&req->out, 
+				      &req->smb_conn->signing.mac_key, 
+				      req->seq_num+1);
+		break;
 	}
-	sign_outgoing_message(&req->out, 
-			      &req->smb_conn->signing.mac_key, 
-			      req->seq_num+1);
+	return;
 }
 
 
+
 /*
   setup the signing key for a connection. Called after authentication succeeds
   in a session setup
 */
-void srv_setup_signing(struct smbsrv_connection *smb_conn,
+BOOL srv_setup_signing(struct smbsrv_connection *smb_conn,
 		       DATA_BLOB *session_key,
-		       DATA_BLOB *session_response)
+		       DATA_BLOB *response)
 {
-	smb_conn->signing.mac_key = data_blob(NULL, 
-					 session_key->length + session_response->length);
-	memcpy(smb_conn->signing.mac_key.data, session_key->data, session_key->length);
-	if (session_response->length != 0) {
-		memcpy(&smb_conn->signing.mac_key.data[session_key->length],
-		       session_response->data, 
-		       session_response->length);
+	if (!set_smb_signing_common(&smb_conn->signing)) {
+		return False;
 	}
+	return smbcli_simple_set_signing(&smb_conn->signing, session_key, response);
 }
 
+void srv_signing_restart(struct smbsrv_connection *smb_conn,
+			 DATA_BLOB *session_key,
+			 DATA_BLOB *response) 
+{
+	if (!smb_conn->signing.seen_valid) {
+		DEBUG(5, ("Client did not send a valid signature on "
+			  "SPENGO session setup - ignored, expect good next time\n"));
+		/* force things back on (most clients do not sign this packet)... */
+		srv_setup_signing(smb_conn, session_key, response);
+		smb_conn->signing.next_seq_num = 2;
+		if (smb_conn->signing.mandatory_signing) {
+			DEBUG(5, ("Configured for mandetory signing, 'good packet seen' forced on\n"));
+			/* if this is mandetory, then
+			 * pretend we have seen a
+			 * valid packet, so we don't
+			 * turn it off */
+			smb_conn->signing.seen_valid = True;
+		}
+	}
+}
+
+BOOL srv_init_signing(struct smbsrv_connection *smb_conn)
+{
+	smb_conn->signing.mac_key = data_blob(NULL, 0);
+	if (!smbcli_set_signing_off(&smb_conn->signing)) {
+		return False;
+	}
+	
+	switch (lp_server_signing()) {
+	case SMB_SIGNING_OFF:
+		smb_conn->signing.allow_smb_signing = False;
+		break;
+	case SMB_SIGNING_SUPPORTED:
+		smb_conn->signing.allow_smb_signing = True;
+		break;
+	case SMB_SIGNING_REQUIRED:
+		smb_conn->signing.allow_smb_signing = True;
+		smb_conn->signing.mandatory_signing = True;
+		break;
+	}
+	return True;
+}
 
 /*
   allocate a sequence number to a request
@@ -68,34 +127,38 @@ static void req_signing_alloc_seq_num(struct smbsrv_request *req)
 	}
 }
 
-/*
-  check the signature of an incoming packet
-*/
+/***********************************************************
+ SMB signing - Simple implementation - check a MAC sent by client
+************************************************************/
+/**
+ * Check a packet supplied by the server.
+ * @return False if we had an established signing connection
+ *         which had a back checksum, True otherwise
+ */
 BOOL req_signing_check_incoming(struct smbsrv_request *req)
 {
-	uint8_t client_md5_mac[8], signature[8];
-
-	switch (req->smb_conn->signing.signing_state) {
-	case SMB_SIGNING_OFF:
-		return True;
-	case SMB_SIGNING_SUPPORTED:
-		if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) {
-			req->smb_conn->signing.signing_state = SMB_SIGNING_REQUIRED;
-		}
-		break;
-	case SMB_SIGNING_REQUIRED:
-		break;
-	}
+	BOOL good;
 
 	req_signing_alloc_seq_num(req);
 
-	/* the first packet isn't checked as the key hasn't been established */
-	if (req->seq_num == 0) {
+	switch (req->smb_conn->signing.signing_state) 
+	{
+	case SMB_SIGNING_ENGINE_OFF:
 		return True;
+	case SMB_SIGNING_ENGINE_BSRSPYL:
+	case SMB_SIGNING_ENGINE_ON:
+	{			
+		if (req->in.size < (HDR_SS_FIELD + 8)) {
+			return False;
+		} else {
+			good = check_signed_incoming_message(&req->in, 
+							     &req->smb_conn->signing.mac_key, 
+							     req->seq_num);
+			
+			return signing_good(&req->smb_conn->signing, 
+					    req->seq_num+1, good);
+		}
 	}
-
-	return check_signed_incoming_message(&req->in,
-					     &req->smb_conn->signing.mac_key,
-					     req->seq_num);
-
+	}
+	return False;
 }
diff --git a/source4/smb_server/smb_server.c b/source4/smb_server/smb_server.c
index ca36dc3aa9..f679a65287 100644
--- a/source4/smb_server/smb_server.c
+++ b/source4/smb_server/smb_server.c
@@ -850,6 +850,8 @@ void smbsrv_accept(struct server_connection *conn)
 
 	smb_conn->sessions.next_vuid = VUID_OFFSET;
 
+	srv_init_signing(smb_conn);
+
 	conn_init(smb_conn);
 
 	smb_conn->connection = conn;
diff --git a/source4/smb_server/smb_server.h b/source4/smb_server/smb_server.h
index ae72bb5da4..4ff246c415 100644
--- a/source4/smb_server/smb_server.h
+++ b/source4/smb_server/smb_server.h
@@ -306,11 +306,7 @@ struct smbsrv_connection {
 		time_t last_smb_conf_reload;
 	} timers;
 
-	struct {
-		DATA_BLOB mac_key;
-		uint64_t next_seq_num;
-		enum smb_signing_state signing_state;
-	} signing;
+	struct smb_signing_context signing;
 
 	struct substitute_context substitute;