summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source3/smbd/smb2_negprot.c10
-rw-r--r--source3/smbd/smb2_sesssetup.c6
2 files changed, 12 insertions, 4 deletions
diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c
index 6adc5819ec..826e0d1d2a 100644
--- a/source3/smbd/smb2_negprot.c
+++ b/source3/smbd/smb2_negprot.c
@@ -92,7 +92,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
DATA_BLOB security_buffer;
size_t expected_dyn_size = 0;
size_t c;
- uint16_t security_mode;
+ uint16_t security_mode = 0;
uint16_t dialect_count;
uint16_t in_security_mode;
uint32_t in_capabilities;
@@ -244,9 +244,11 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
}
- security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
- if (lp_server_signing() == SMB_SIGNING_REQUIRED) {
- security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
+ if (lp_server_signing() != SMB_SIGNING_OFF) {
+ security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
+ if (lp_server_signing() == SMB_SIGNING_REQUIRED) {
+ security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
+ }
}
capabilities = 0;
diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
index 2599d2a63d..8bdfd49644 100644
--- a/source3/smbd/smb2_sesssetup.c
+++ b/source3/smbd/smb2_sesssetup.c
@@ -185,6 +185,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
struct smbXsrv_session *x = session;
struct smbXsrv_connection *conn = session->connection;
+ if ((lp_server_signing() == SMB_SIGNING_OFF) &&
+ (in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) {
+ DEBUG(0,("SMB2 signing required and we have disabled it.\n"));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
lp_server_signing() == SMB_SIGNING_REQUIRED) {
x->global->signing_required = true;