sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Code

libcli/smb: actually make use of "client/server smb3 signing algorithms"

Browse Source 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
This commit is contained in:
Stefan Metzmacher 2021-07-13 21:26:19 +02:00
parent be71039be4
commit 982bdcf427
6 changed files with 39 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libcli/smb/smb2_negotiate_context.h
View File

@ -77,6 +77,7 @@ const char *smb3_signing_algorithm_name(uint16_t algo);
const char *smb3_encryption_algorithm_name(uint16_t algo);
struct smb311_capabilities smb311_capabilities_parse(const char *role,
const char * const *signing_algos,
const char * const *encryption_algos);
NTSTATUS smb311_capabilities_check(const struct smb311_capabilities *c,
@ -85,6 +86,7 @@ NTSTATUS smb311_capabilities_check(const struct smb311_capabilities *c,
NTSTATUS error_status,
const char *role,
enum protocol_types protocol,
uint16_t sign_algo,
uint16_t cipher_algo);
#endif /* _LIBCLI_SMB_SMB2_NEGOTIATE_BLOB_H_ */

1
libcli/smb/smbXcli_base.c
View File

@ -5415,6 +5415,7 @@ static NTSTATUS smbXcli_negprot_smb3_check_capabilities(struct tevent_req *req)
NT_STATUS_ACCESS_DENIED,
"client",
conn->protocol,
conn->smb2.server.sign_algo,
conn->smb2.server.cipher);
}

33
libcli/smb/util.c
View File

@ -531,9 +531,9 @@ static int32_t parse_enum_val(const struct enum_list *e,
}
struct smb311_capabilities smb311_capabilities_parse(const char *role,
const char * const *signing_algos,
const char * const *encryption_algos)
{
const char * const *signing_algos = NULL;
struct smb311_capabilities c = {
.signing = {
.num_algos = 0,
@ -638,13 +638,27 @@ NTSTATUS smb311_capabilities_check(const struct smb311_capabilities *c,
NTSTATUS error_status,
const char *role,
enum protocol_types protocol,
uint16_t sign_algo,
uint16_t cipher_algo)
{
const struct smb3_signing_capabilities *sign_algos =
&c->signing;
const struct smb3_encryption_capabilities *ciphers =
&c->encryption;
bool found_signing = false;
bool found_encryption = false;
size_t i;
for (i = 0; i < sign_algos->num_algos; i++) {
if (sign_algo == sign_algos->algos[i]) {
/*
* We found a match
*/
found_signing = true;
break;
}
}
for (i = 0; i < ciphers->num_algos; i++) {
if (cipher_algo == SMB2_ENCRYPTION_NONE) {
/*
@ -663,6 +677,23 @@ NTSTATUS smb311_capabilities_check(const struct smb311_capabilities *c,
}
}
if (!found_signing) {
/*
* We negotiated a signing algo we don't allow,
* most likely for SMB < 3.1.1
*/
DEBUG(debug_lvl,("%s: "
"SMB3 signing algorithm[%u][%s] on dialect[%s] "
"not allowed by '%s smb3 signing algorithms' - %s.\n",
debug_prefix,
sign_algo,
smb3_signing_algorithm_name(sign_algo),
smb_protocol_types_string(protocol),
role,
nt_errstr(error_status)));
return error_status;
}
if (!found_encryption) {
/*
* We negotiated a cipher we don't allow,

1
source3/libsmb/clientgen.c
View File

@ -72,6 +72,7 @@ struct cli_state *cli_state_create(TALLOC_CTX *mem_ctx,
uint32_t smb2_capabilities = 0;
struct smb311_capabilities smb3_capabilities =
smb311_capabilities_parse("client",
lp_client_smb3_signing_algorithms(),
lp_client_smb3_encryption_algorithms());
struct GUID client_guid;

2
source3/smbd/smb2_negprot.c
View File

@ -160,6 +160,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
struct smb2_negotiate_contexts out_c = { .num_contexts = 0, };
const struct smb311_capabilities default_smb3_capabilities =
smb311_capabilities_parse("server",
lp_server_smb3_signing_algorithms(),
lp_server_smb3_encryption_algorithms());
DATA_BLOB out_negotiate_context_blob = data_blob_null;
uint32_t out_negotiate_context_offset = 0;
@ -621,6 +622,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
NT_STATUS_INVALID_PARAMETER,
"server",
protocol,
xconn->smb2.server.sign_algo,
xconn->smb2.server.cipher);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);

1
source4/param/loadparm.c
View File

@ -51,6 +51,7 @@ void lpcfg_smbcli_options(struct loadparm_context *lp_ctx,
.client_guid = GUID_random(),
.max_credits = WINDOWS_CLIENT_PURE_SMB2_NEGPROT_INITIAL_CREDIT_ASK,
.smb3_capabilities = smb311_capabilities_parse("client",
lpcfg_client_smb3_signing_algorithms(lp_ctx),
lpcfg_client_smb3_encryption_algorithms(lp_ctx)),
};
}