From 7b088a8f654f34911928dcdf320ca3cf79592aed Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 13 Aug 2004 00:16:57 +0000 Subject: r1796: Enable server-side SPNEGO, now that I have fixed the server-side SMB signing code to be able to cope. Andrew Bartlett (This used to be commit cb74d52b563730a50e33c92d868c45ee96a598e8) --- source4/smb_server/negprot.c | 37 +++++++---- source4/smb_server/request.c | 2 +- source4/smb_server/sesssetup.c | 30 ++++++--- source4/smb_server/signing.c | 139 +++++++++++++++++++++++++++++----------- source4/smb_server/smb_server.c | 2 + source4/smb_server/smb_server.h | 6 +- 6 files changed, 152 insertions(+), 64 deletions(-) (limited to 'source4/smb_server') diff --git a/source4/smb_server/negprot.c b/source4/smb_server/negprot.c index 9e8a8f1f2c..d81900107b 100644 --- a/source4/smb_server/negprot.c +++ b/source4/smb_server/negprot.c @@ -57,6 +57,11 @@ static void reply_corep(struct smbsrv_request *req, uint16_t choice) req->smb_conn->negotiate.protocol = PROTOCOL_CORE; + if (req->smb_conn->signing.mandatory_signing) { + smbsrv_terminate_connection(req->smb_conn, + "CORE does not support SMB signing, and it is mandetory\n"); + } + req_send_reply(req); } @@ -84,6 +89,11 @@ static void reply_coreplus(struct smbsrv_request *req, uint16_t choice) req->smb_conn->negotiate.protocol = PROTOCOL_COREPLUS; + if (req->smb_conn->signing.mandatory_signing) { + smbsrv_terminate_connection(req->smb_conn, + "COREPLUS does not support SMB signing, and it is mandetory\n"); + } + req_send_reply(req); } @@ -128,6 +138,11 @@ static void reply_lanman1(struct smbsrv_request *req, uint16_t choice) get_challenge(req->smb_conn, req->out.data); } + if (req->smb_conn->signing.mandatory_signing) { + smbsrv_terminate_connection(req->smb_conn, + "LANMAN1 does not support SMB signing, and it is mandetory\n"); + } + req_send_reply(req); } @@ -171,6 +186,10 @@ static void reply_lanman2(struct smbsrv_request *req, uint16_t choice) req_push_str(req, NULL, lp_workgroup(), -1, STR_TERMINATE); + if (req->smb_conn->signing.mandatory_signing) { + smbsrv_terminate_connection(req->smb_conn, + "LANMAN2 does not support SMB signing, and it is mandetory\n"); + } req_send_reply(req); } @@ -198,7 +217,7 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice) /* do spnego in user level security if the client supports it and we can do encrypted passwords */ - if (0 && req->smb_conn->negotiate.encrypted_passwords && + if (req->smb_conn->negotiate.encrypted_passwords && (lp_security() != SEC_SHARE) && lp_use_spnego() && (req->flags2 & FLAGS2_EXTENDED_SECURITY)) { @@ -241,18 +260,12 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice) secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE; } - req->smb_conn->signing.signing_state = lp_server_signing(); - - switch (req->smb_conn->signing.signing_state) { - case SMB_SIGNING_OFF: - break; - case SMB_SIGNING_SUPPORTED: + if (req->smb_conn->signing.allow_smb_signing) { secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED; - break; - case SMB_SIGNING_REQUIRED: - secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED | - NEGOTIATE_SECURITY_SIGNATURES_REQUIRED; - break; + } + + if (req->smb_conn->signing.mandatory_signing) { + secword |= NEGOTIATE_SECURITY_SIGNATURES_REQUIRED; } req->smb_conn->negotiate.protocol = PROTOCOL_NT1; diff --git a/source4/smb_server/request.c b/source4/smb_server/request.c index f4cdba79cc..e9aeb168bc 100644 --- a/source4/smb_server/request.c +++ b/source4/smb_server/request.c @@ -263,7 +263,7 @@ void req_send_reply_nosign(struct smbsrv_request *req) } if (write_data(req->smb_conn->connection->socket->fde->fd, req->out.buffer, req->out.size) != req->out.size) { - smb_panic("failed to send reply\n"); + smbsrv_terminate_connection(req->smb_conn, "failed to send reply\n"); } req_destroy(req); diff --git a/source4/smb_server/sesssetup.c b/source4/smb_server/sesssetup.c index e1245748a0..a87db0ecc4 100644 --- a/source4/smb_server/sesssetup.c +++ b/source4/smb_server/sesssetup.c @@ -160,9 +160,18 @@ static NTSTATUS sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *s &sess->nt1.out.domain); req->session = smbsrv_session_find(req->smb_conn, sess->nt1.out.vuid); - if (!session_info->server_info->guest) { - srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2); + if (session_info->server_info->guest) { + return NT_STATUS_OK; } + if (!srv_setup_signing(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2)) { + /* Already signing, or disabled */ + return NT_STATUS_OK; + } + + /* Force check of the request packet, now we know the session key */ + req_signing_check_incoming(req); + + srv_signing_restart(req->smb_conn, &session_info->session_key, &sess->nt1.in.password2); return NT_STATUS_OK; } @@ -227,7 +236,6 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup if (NT_STATUS_IS_OK(status)) { DATA_BLOB session_key; - DATA_BLOB null_data_blob = data_blob(NULL, 0); status = gensec_session_info(smb_sess->gensec_ctx, &smb_sess->session_info); if (!NT_STATUS_IS_OK(status)) { @@ -235,12 +243,18 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup } status = gensec_session_key(smb_sess->gensec_ctx, - &session_key); - if (NT_STATUS_IS_OK(status)) { - srv_setup_signing(req->smb_conn, &session_key, &null_data_blob); - req->seq_num = 0; - req->smb_conn->signing.next_seq_num = 2; + &session_key); + if (NT_STATUS_IS_OK(status) + && !smb_sess->session_info->server_info->guest + && srv_setup_signing(req->smb_conn, &session_key, NULL)) { + /* Force check of the request packet, now we know the session key */ + req_signing_check_incoming(req); + + srv_signing_restart(req->smb_conn, &session_key, NULL); + } + } else { + status = nt_status_squash(status); } sess->spnego.out.action = 0; diff --git a/source4/smb_server/signing.c b/source4/smb_server/signing.c index 37c1f6f7b1..555a71c0a9 100644 --- a/source4/smb_server/signing.c +++ b/source4/smb_server/signing.c @@ -25,34 +25,93 @@ */ void req_sign_packet(struct smbsrv_request *req) { - /* check if we are doing signing on this connection */ - if (req->smb_conn->signing.signing_state != SMB_SIGNING_REQUIRED) { - return; +#if 0 + /* enable this when packet signing is preventing you working out why valgrind + says that data is uninitialised */ + file_save("pkt.dat", req->out.buffer, req->out.size); +#endif + + switch (req->smb_conn->signing.signing_state) { + case SMB_SIGNING_ENGINE_OFF: + break; + + case SMB_SIGNING_ENGINE_BSRSPYL: + /* mark the packet as signed - BEFORE we sign it...*/ + mark_packet_signed(&req->out); + + /* I wonder what BSRSPYL stands for - but this is what MS + actually sends! */ + memcpy((req->out.hdr + HDR_SS_FIELD), "BSRSPYL ", 8); + break; + + case SMB_SIGNING_ENGINE_ON: + + sign_outgoing_message(&req->out, + &req->smb_conn->signing.mac_key, + req->seq_num+1); + break; } - sign_outgoing_message(&req->out, - &req->smb_conn->signing.mac_key, - req->seq_num+1); + return; } + /* setup the signing key for a connection. Called after authentication succeeds in a session setup */ -void srv_setup_signing(struct smbsrv_connection *smb_conn, +BOOL srv_setup_signing(struct smbsrv_connection *smb_conn, DATA_BLOB *session_key, - DATA_BLOB *session_response) + DATA_BLOB *response) { - smb_conn->signing.mac_key = data_blob(NULL, - session_key->length + session_response->length); - memcpy(smb_conn->signing.mac_key.data, session_key->data, session_key->length); - if (session_response->length != 0) { - memcpy(&smb_conn->signing.mac_key.data[session_key->length], - session_response->data, - session_response->length); + if (!set_smb_signing_common(&smb_conn->signing)) { + return False; } + return smbcli_simple_set_signing(&smb_conn->signing, session_key, response); } +void srv_signing_restart(struct smbsrv_connection *smb_conn, + DATA_BLOB *session_key, + DATA_BLOB *response) +{ + if (!smb_conn->signing.seen_valid) { + DEBUG(5, ("Client did not send a valid signature on " + "SPENGO session setup - ignored, expect good next time\n")); + /* force things back on (most clients do not sign this packet)... */ + srv_setup_signing(smb_conn, session_key, response); + smb_conn->signing.next_seq_num = 2; + if (smb_conn->signing.mandatory_signing) { + DEBUG(5, ("Configured for mandetory signing, 'good packet seen' forced on\n")); + /* if this is mandetory, then + * pretend we have seen a + * valid packet, so we don't + * turn it off */ + smb_conn->signing.seen_valid = True; + } + } +} + +BOOL srv_init_signing(struct smbsrv_connection *smb_conn) +{ + smb_conn->signing.mac_key = data_blob(NULL, 0); + if (!smbcli_set_signing_off(&smb_conn->signing)) { + return False; + } + + switch (lp_server_signing()) { + case SMB_SIGNING_OFF: + smb_conn->signing.allow_smb_signing = False; + break; + case SMB_SIGNING_SUPPORTED: + smb_conn->signing.allow_smb_signing = True; + break; + case SMB_SIGNING_REQUIRED: + smb_conn->signing.allow_smb_signing = True; + smb_conn->signing.mandatory_signing = True; + break; + } + return True; +} /* allocate a sequence number to a request @@ -68,34 +127,38 @@ static void req_signing_alloc_seq_num(struct smbsrv_request *req) } } -/* - check the signature of an incoming packet -*/ +/*********************************************************** + SMB signing - Simple implementation - check a MAC sent by client +************************************************************/ +/** + * Check a packet supplied by the server. + * @return False if we had an established signing connection + * which had a back checksum, True otherwise + */ BOOL req_signing_check_incoming(struct smbsrv_request *req) { - uint8_t client_md5_mac[8], signature[8]; - - switch (req->smb_conn->signing.signing_state) { - case SMB_SIGNING_OFF: - return True; - case SMB_SIGNING_SUPPORTED: - if (req->flags2 & FLAGS2_SMB_SECURITY_SIGNATURES) { - req->smb_conn->signing.signing_state = SMB_SIGNING_REQUIRED; - } - break; - case SMB_SIGNING_REQUIRED: - break; - } + BOOL good; req_signing_alloc_seq_num(req); - /* the first packet isn't checked as the key hasn't been established */ - if (req->seq_num == 0) { + switch (req->smb_conn->signing.signing_state) + { + case SMB_SIGNING_ENGINE_OFF: return True; + case SMB_SIGNING_ENGINE_BSRSPYL: + case SMB_SIGNING_ENGINE_ON: + { + if (req->in.size < (HDR_SS_FIELD + 8)) { + return False; + } else { + good = check_signed_incoming_message(&req->in, + &req->smb_conn->signing.mac_key, + req->seq_num); + + return signing_good(&req->smb_conn->signing, + req->seq_num+1, good); + } } - - return check_signed_incoming_message(&req->in, - &req->smb_conn->signing.mac_key, - req->seq_num); - + } + return False; } diff --git a/source4/smb_server/smb_server.c b/source4/smb_server/smb_server.c index ca36dc3aa9..f679a65287 100644 --- a/source4/smb_server/smb_server.c +++ b/source4/smb_server/smb_server.c @@ -850,6 +850,8 @@ void smbsrv_accept(struct server_connection *conn) smb_conn->sessions.next_vuid = VUID_OFFSET; + srv_init_signing(smb_conn); + conn_init(smb_conn); smb_conn->connection = conn; diff --git a/source4/smb_server/smb_server.h b/source4/smb_server/smb_server.h index ae72bb5da4..4ff246c415 100644 --- a/source4/smb_server/smb_server.h +++ b/source4/smb_server/smb_server.h @@ -306,11 +306,7 @@ struct smbsrv_connection { time_t last_smb_conf_reload; } timers; - struct { - DATA_BLOB mac_key; - uint64_t next_seq_num; - enum smb_signing_state signing_state; - } signing; + struct smb_signing_context signing; struct substitute_context substitute; -- cgit