1 files changed, 21 insertions, 21 deletions

diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c
index cafaacd8bb..63f3a8e10d 100644
--- a/source4/libcli/smb_composite/sesssetup.c
+++ b/source4/libcli/smb_composite/sesssetup.c
@@ -31,6 +31,7 @@
 #include "auth/credentials/credentials.h"
 #include "version.h"
 #include "param/param.h"
+#include "libcli/smb/smbXcli_base.h"
 
 struct sesssetup_state {
 	union smb_sesssetup setup;
@@ -200,7 +201,9 @@ static void request_handler(struct smbcli_request *req)
 			}
 			session_key_err = gensec_session_key(session->gensec, session, &session->user_session_key);
 			if (NT_STATUS_IS_OK(session_key_err)) {
-				smbcli_transport_simple_set_signing(session->transport, session->user_session_key, null_data_blob);
+				smb1cli_conn_activate_signing(session->transport->conn,
+							      session->user_session_key,
+							      null_data_blob);
 			}
 		}
 
@@ -213,7 +216,8 @@ static void request_handler(struct smbcli_request *req)
 			session->vuid = state->io->out.vuid;
 			state->req = smb_raw_sesssetup_send(session, &state->setup);
 			session->vuid = vuid;
-			if (state->req) {
+			if (state->req &&
+			    !smb1cli_conn_signing_is_active(state->req->transport->conn)) {
 				state->req->sign_caller_checks = true;
 			}
 			composite_continue_smb(c, state->req, request_handler, c);
@@ -229,23 +233,19 @@ static void request_handler(struct smbcli_request *req)
 	}
 
 	if (check_req) {
+		bool ok;
+
 		check_req->sign_caller_checks = false;
-		if (!smbcli_request_check_sign_mac(check_req)) {
+
+		ok = smb1cli_conn_check_signing(check_req->transport->conn,
+						check_req->in.buffer, 1);
+		if (!ok) {
 			c->status = NT_STATUS_ACCESS_DENIED;
 		}
 		talloc_free(check_req);
 		check_req = NULL;
 	}
 
-	/* enforce the local signing required flag */
-	if (NT_STATUS_IS_OK(c->status) && !cli_credentials_is_anonymous(state->io->in.credentials)) {
-		if (!session->transport->negotiate.sign_info.doing_signing 
-		    && session->transport->negotiate.sign_info.mandatory_signing) {
-			DEBUG(0, ("SMB signing required, but server does not support it\n"));
-			c->status = NT_STATUS_ACCESS_DENIED;
-		}
-	}
-
 	if (!NT_STATUS_IS_OK(c->status)) {
 		composite_error(c, c->status);
 		return;
@@ -291,8 +291,6 @@ static NTSTATUS session_setup_nt1(struct composite_context *c,
 	DATA_BLOB session_key = data_blob(NULL, 0);
 	int flags = CLI_CRED_NTLM_AUTH;
 
-	smbcli_temp_set_signing(session->transport);
-
 	if (session->options.lanman_auth) {
 		flags |= CLI_CRED_LANMAN_AUTH;
 	}
@@ -339,10 +337,11 @@ static NTSTATUS session_setup_nt1(struct composite_context *c,
 	}
 
 	if (NT_STATUS_IS_OK(nt_status)) {
-		smbcli_transport_simple_set_signing(session->transport, session_key, 
-						    state->setup.nt1.in.password2);
+		smb1cli_conn_activate_signing(session->transport->conn,
+					      session_key,
+					      state->setup.nt1.in.password2);
 		set_user_session_key(session, &session_key);
-		
+
 		data_blob_free(&session_key);
 	}
 
@@ -441,8 +440,6 @@ static NTSTATUS session_setup_spnego(struct composite_context *c,
 	state->setup.spnego.in.lanman       = talloc_asprintf(state, "Samba %s", SAMBA_VERSION_STRING);
 	state->setup.spnego.in.workgroup    = io->in.workgroup;
 
-	smbcli_temp_set_signing(session->transport);
-
 	status = gensec_client_start(session, &session->gensec,
 				     io->in.gensec_settings);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -459,7 +456,8 @@ static NTSTATUS session_setup_spnego(struct composite_context *c,
 		return status;
 	}
 
-	status = gensec_set_target_hostname(session->gensec, session->transport->socket->hostname);
+	status = gensec_set_target_hostname(session->gensec,
+			smbXcli_conn_remote_name(session->transport->conn));
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(1, ("Failed to start set GENSEC target hostname: %s\n", 
 			  nt_errstr(status)));
@@ -530,7 +528,9 @@ static NTSTATUS session_setup_spnego(struct composite_context *c,
 	 * as the session key might be the acceptor subkey
 	 * which comes within the response itself
 	 */
-	(*req)->sign_caller_checks = true;
+	if (!smb1cli_conn_signing_is_active((*req)->transport->conn)) {
+		(*req)->sign_caller_checks = true;
+	}
 
 	return (*req)->status;
 }