summaryrefslogtreecommitdiff
path: root/source4/smb_server
diff options
context:
space:
mode:
Diffstat (limited to 'source4/smb_server')
-rw-r--r--source4/smb_server/negprot.c37
-rw-r--r--source4/smb_server/request.c2
-rw-r--r--source4/smb_server/sesssetup.c30
-rw-r--r--source4/smb_server/signing.c139
-rw-r--r--source4/smb_server/smb_server.c2
-rw-r--r--source4/smb_server/smb_server.h6
6 files changed, 152 insertions, 64 deletions
diff --git a/source4/smb_server/negprot.c b/source4/smb_server/negprot.c
index 9e8a8f1f2c..d81900107b 100644
--- a/source4/smb_server/negprot.c
+++ b/source4/smb_server/negprot.c
@@ -57,6 +57,11 @@ static void reply_corep(struct smbsrv_request *req, uint16_t choice)
req->smb_conn->negotiate.protocol = PROTOCOL_CORE;
+ if (req->smb_conn->signing.mandatory_signing) {
+ smbsrv_terminate_connection(req->smb_conn,
+ "CORE does not support SMB signing, and it is mandetory\n");
+ }
+
req_send_reply(req);
}
@@ -84,6 +89,11 @@ static void reply_coreplus(struct smbsrv_request *req, uint16_t choice)
req->smb_conn->negotiate.protocol = PROTOCOL_COREPLUS;
+ if (req->smb_conn->signing.mandatory_signing) {
+ smbsrv_terminate_connection(req->smb_conn,
+ "COREPLUS does not support SMB signing, and it is mandetory\n");
+ }
+
req_send_reply(req);
}
@@ -128,6 +138,11 @@ static void reply_lanman1(struct smbsrv_request *req, uint16_t choice)
get_challenge(req->smb_conn, req->out.data);
}
+ if (req->smb_conn->signing.mandatory_signing) {
+ smbsrv_terminate_connection(req->smb_conn,
+ "LANMAN1 does not support SMB signing, and it is mandetory\n");
+ }
+
req_send_reply(req);
}
@@ -171,6 +186,10 @@ static void reply_lanman2(struct smbsrv_request *req, uint16_t choice)
req_push_str(req, NULL, lp_workgroup(), -1, STR_TERMINATE);
+ if (req->smb_conn->signing.mandatory_signing) {
+ smbsrv_terminate_connection(req->smb_conn,
+ "LANMAN2 does not support SMB signing, and it is mandetory\n");
+ }
req_send_reply(req);
}
@@ -198,7 +217,7 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice)
/* do spnego in user level security if the client
supports it and we can do encrypted passwords */
- if (0 && req->smb_conn->negotiate.encrypted_passwords &&
+ if (req->smb_conn->negotiate.encrypted_passwords &&
(lp_security() != SEC_SHARE) &&
lp_use_spnego() &&
(req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
@@ -241,18 +260,12 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice)
secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE;
}
- req->smb_conn->signing.signing_state = lp_server_signing();
-
- switch (req->smb_conn->signing.signing_state) {
- case SMB_SIGNING_OFF:
- break;
- case SMB_SIGNING_SUPPORTED:
+ if (req->smb_conn->signing.allow_smb_signing) {
secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
- break;
- case SMB_SIGNING_REQUIRED:
- secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED |
- NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
- break;
+ }
+
+ if (req->smb_conn->signing.mandatory_signing) {
+ secword |= NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
}
req->smb_conn->negotiate.protocol = PROTOCOL_NT1;
diff --git a/source4/smb_server/request.c b/source4/smb_server/request.c
index f4cdba79cc..e9aeb168bc 100644
--- a/source4/smb_server/request.c
+++ b/source4/smb_server/request.c
@@ -263,7 +263,7 @@ void req_send_reply_nosign(struct smbsrv_request *req)
}
if (write_data(req->smb_conn->connection->socket->fde->fd, req->out.buffer, req->out.size) != req->out.size) {
- smb_panic("failed to send reply\n");
+ smbsrv_terminate_connection(req->smb_conn, "failed to send reply\n");
}
req_destroy(req);
diff --git a/source4/smb_server/sesssetup.c b/source4/smb_server/sesssetup.c
index e1245748a0..a87db0ecc4 100644
--- a/source4/smb_server/sesssetup.c
+++ b/source4/smb_server/sesssetup.c
@@ -160,9 +160,18 @@ static NTSTATUS sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *s
&sess->nt1.out.domain);
req->session = smbsrv_session_find(req->smb_conn, sess->nt1.out.vuid);
- if (!session_info->server_info->guest) {
- srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2);
+ if (session_info->server_info->guest) {
+ return NT_STATUS_OK;
}
+ if (!srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2)) {
+ /* Already signing, or disabled */
+ return NT_STATUS_OK;
+ }
+
+ /* Force check of the request packet, now we know the session key */
+ req_signing_check_incoming(req);
+
+ srv_signing_restart(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2);
return NT_STATUS_OK;
}
@@ -227,7 +236,6 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup
if (NT_STATUS_IS_OK(status)) {
DATA_BLOB session_key;
- DATA_BLOB null_data_blob = data_blob(NULL, 0);
status = gensec_session_info(smb_sess->gensec_ctx, &smb_sess->session_info);
if (!NT_STATUS_IS_OK(status)) {
@@ -235,12 +243,18 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup
}
status = gensec_session_key(smb_sess->gensec_ctx,
- &session_key);
- if (NT_STATUS_IS_OK(status)) {
- srv_setup_signing(req->smb_conn, &session_key, &null_data_blob);
- req->seq_num = 0;
- req->smb_conn->signing.next_seq_num = 2;
+ &session_key);
+ if (NT_STATUS_IS_OK(status)
+ && !smb_sess->session_info->server_info->guest
+ && srv_setup_signing(req->smb_conn, &session_key, NULL)) {
+ /* Force check of the request packet, now we know the session key */
+ req_signing_check_incoming(req);
+
+ srv_signing_restart(req->smb_conn, &session_key, NULL);
+
}
+ } else {
+ status = nt_status_squash(status);
}
sess->spnego.out.action = 0;
diff --git a/source4/smb_server/signing.c b/source4/smb_server/signing.c
index 37c1f6f7b1..555a71c0a9 100644
--- a/source4/smb_server/signing.c
+++ b/source4/smb_server/signing.c
@@ -25,34 +25,93 @@
*/
void req_sign_packet(struct smbsrv_request *req)
{
- /* check if we are doing signing on this connection */
- if (req->smb_conn->signing.signing_state != SMB_SIGNING_REQUIRED) {
- return;
+#if 0
+ /* enable this when packet signing is preventing you working out why valgrind
+ says that data is uninitialised */
+ file_save("pkt.dat", req->out.buffer, req->out.size);
+#endif
+
+ switch (req->smb_conn->signing.signing_state) {
+ case SMB_SIGNING_ENGINE_OFF:
+ break;
+
+ case SMB_SIGNING_ENGINE_BSRSPYL:
+ /* mark the packet as signed - BEFORE we sign it...*/
+ mark_packet_signed(&req->out);
+
+ /* I wonder what BSRSPYL stands for - but this is what MS
+ actually sends! */
+ memcpy((req->out.hdr + HDR_SS_FIELD), "BSRSPYL ", 8);
+ break;
+
+ case SMB_SIGNING_ENGINE_ON:
+
+ sign_outgoing_message(&req->out,
+ &req->smb_conn->signing.mac_key,
+ req->seq_num+1);
+ break;
}
- sign_outgoing_message(&req->out,
- &req->smb_conn->signing.mac_key,
- req->seq_num+1);
+ return;
}
+
/*
setup the signing key for a connection. Called after authentication succeeds
in a session setup
*/
-void srv_setup_signing(struct smbsrv_connection *smb_conn,
+BOOL srv_setup_signing(struct smbsrv_connection *smb_conn,
DATA_BLOB *session_key,
- DATA_BLOB *session_response)
+ DATA_BLOB *response)
{
- smb_conn->signing.mac_key = data_blob(NULL,
- session_key->length + session_response->length);
- memcpy(smb_conn->signing.mac_key.data, session_key->data, session_key->length);
- if (session_response->length != 0) {
- memcpy(&smb_conn->signing.mac_key.data[session_key->length],
- session_response->data,
- session_response->length);
+ if (!set_smb_signing_common(&smb_conn->signing)) {
+ return False;
}
+ return smbcli_simple_set_signing(&smb_conn->signing, session_key, response);
}
+void srv_signing_restart(struct smbsrv_connection *smb_conn,
+ DATA_BLOB *session_key,
+ DATA_BLOB *response)
+{
+ if (!smb_conn->signing.seen_valid) {
+ DEBUG(5, ("Client did not send a valid signature on "
+ "SPENGO session setup - ignored, expect good next time\n"));
+ /* force things back on (most clients do not sign this packet)... */
+ srv_setup_signing(smb_conn, session_key, response);
+ smb_conn->signing.next_seq_num = 2;
+ if (smb_conn->signing.mandatory_signing) {
+ DEBUG(5, ("Configured for mandetory signing, 'good packet seen' forced on\n"));
+ /* if this is mandetory, then
+ * pretend we have seen a
+ * valid packet, so we don't
+ * turn it off */
+ smb_conn->signing.seen_valid = True;
+ }
+ }
+}
+
+BOOL srv_init_signing(struct smbsrv_connection *smb_conn)
+{
+ smb_conn->signing.mac_key = data_blob(NULL, 0);
+ if (!smbcli_set_signing_off(&smb_conn->signing)) {
+ return False;
+ }
+
+ switch (lp_server_signing()) {
+ case SMB_SIGNING_OFF:
+ smb_conn->signing.allow_smb_signing = False;
+ break;
+ case SMB_SIGNING_SUPPORTED:
+ smb_conn->signing.allow_smb_signing = True;
+ break;
+ case SMB_SIGNING_REQUIRED:
+ smb_conn->signing.allow_smb_signing = True;
+ smb_conn->signing.mandatory_signing = True;
+ break;
+ }
+ return True;
+}
/*
allocate a sequence number to a request
@@ -68,34 +127,38 @@ static void req_signing_alloc_seq_num(struct smbsrv_request *req)
}
}
-/*
- check the signature of an incoming packet
-*/
+/***********************************************************
+ SMB signing - Simple implementation - check a MAC sent by client
+************************************************************/
+/**
+ * Check a packet supplied by the server.
+ * @return False if we had an established signing connection
+ * which had a back checksum, True otherwise
+ */
BOOL req_signing_check_incoming(struct smbsrv_request *req)
{
- uint8_t client_md5_mac[8], signature[8];
-
- switch (req->smb_conn->signing.signing_state) {
- case SMB_SIGNING_OFF:
- return True;
- case SMB_SIGNING_SUPPORTED:
- if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) {
- req->smb_conn->signing.signing_state = SMB_SIGNING_REQUIRED;
- }
- break;
- case SMB_SIGNING_REQUIRED:
- break;
- }
+ BOOL good;
req_signing_alloc_seq_num(req);
- /* the first packet isn't checked as the key hasn't been established */
- if (req->seq_num == 0) {
+ switch (req->smb_conn->signing.signing_state)
+ {
+ case SMB_SIGNING_ENGINE_OFF:
return True;
+ case SMB_SIGNING_ENGINE_BSRSPYL:
+ case SMB_SIGNING_ENGINE_ON:
+ {
+ if (req->in.size < (HDR_SS_FIELD + 8)) {
+ return False;
+ } else {
+ good = check_signed_incoming_message(&req->in,
+ &req->smb_conn->signing.mac_key,
+ req->seq_num);
+
+ return signing_good(&req->smb_conn->signing,
+ req->seq_num+1, good);
+ }
}
-
- return check_signed_incoming_message(&req->in,
- &req->smb_conn->signing.mac_key,
- req->seq_num);
-
+ }
+ return False;
}
diff --git a/source4/smb_server/smb_server.c b/source4/smb_server/smb_server.c
index ca36dc3aa9..f679a65287 100644
--- a/source4/smb_server/smb_server.c
+++ b/source4/smb_server/smb_server.c
@@ -850,6 +850,8 @@ void smbsrv_accept(struct server_connection *conn)
smb_conn->sessions.next_vuid = VUID_OFFSET;
+ srv_init_signing(smb_conn);
+
conn_init(smb_conn);
smb_conn->connection = conn;
diff --git a/source4/smb_server/smb_server.h b/source4/smb_server/smb_server.h
index ae72bb5da4..4ff246c415 100644
--- a/source4/smb_server/smb_server.h
+++ b/source4/smb_server/smb_server.h
@@ -306,11 +306,7 @@ struct smbsrv_connection {
time_t last_smb_conf_reload;
} timers;
- struct {
- DATA_BLOB mac_key;
- uint64_t next_seq_num;
- enum smb_signing_state signing_state;
- } signing;
+ struct smb_signing_context signing;
struct substitute_context substitute;