2 Unix SMB/CIFS implementation.
4 Copyright (C) Andrew Tridgell 2004
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "smb_server/smb_server.h"
22 #include "libcli/raw/libcliraw.h"
26 sign an outgoing packet
28 void smbsrv_sign_packet(struct smbsrv_request *req)
31 /* enable this when packet signing is preventing you working out why valgrind
32 says that data is uninitialised */
33 file_save("pkt.dat", req->out.buffer, req->out.size);
36 switch (req->smb_conn->signing.signing_state) {
37 case SMB_SIGNING_ENGINE_OFF:
40 case SMB_SIGNING_ENGINE_BSRSPYL:
41 /* mark the packet as signed - BEFORE we sign it...*/
42 mark_packet_signed(&req->out);
44 /* I wonder what BSRSPYL stands for - but this is what MS
46 memcpy((req->out.hdr + HDR_SS_FIELD), "BSRSPYL ", 8);
49 case SMB_SIGNING_ENGINE_ON:
51 sign_outgoing_message(&req->out,
52 &req->smb_conn->signing.mac_key,
62 setup the signing key for a connection. Called after authentication succeeds
65 BOOL smbsrv_setup_signing(struct smbsrv_connection *smb_conn,
66 DATA_BLOB *session_key,
69 if (!set_smb_signing_common(&smb_conn->signing)) {
72 return smbcli_simple_set_signing(smb_conn,
73 &smb_conn->signing, session_key, response);
76 void smbsrv_signing_restart(struct smbsrv_connection *smb_conn,
77 DATA_BLOB *session_key,
80 if (!smb_conn->signing.seen_valid) {
81 DEBUG(5, ("Client did not send a valid signature on "
82 "SPNEGO session setup - ignored, expect good next time\n"));
83 /* force things back on (most clients do not sign this packet)... */
84 smbsrv_setup_signing(smb_conn, session_key, response);
85 smb_conn->signing.next_seq_num = 2;
86 if (smb_conn->signing.mandatory_signing) {
87 DEBUG(5, ("Configured for mandatory signing, 'good packet seen' forced on\n"));
88 /* if this is mandatory, then
89 * pretend we have seen a
90 * valid packet, so we don't
92 smb_conn->signing.seen_valid = True;
97 BOOL smbsrv_init_signing(struct smbsrv_connection *smb_conn)
99 smb_conn->signing.mac_key = data_blob(NULL, 0);
100 if (!smbcli_set_signing_off(&smb_conn->signing)) {
104 switch (lp_server_signing()) {
105 case SMB_SIGNING_OFF:
106 smb_conn->signing.allow_smb_signing = False;
108 case SMB_SIGNING_SUPPORTED:
109 smb_conn->signing.allow_smb_signing = True;
111 case SMB_SIGNING_REQUIRED:
112 smb_conn->signing.allow_smb_signing = True;
113 smb_conn->signing.mandatory_signing = True;
115 case SMB_SIGNING_AUTO:
116 if (lp_domain_logons()) {
117 smb_conn->signing.allow_smb_signing = True;
119 smb_conn->signing.allow_smb_signing = False;
127 allocate a sequence number to a request
129 static void req_signing_alloc_seq_num(struct smbsrv_request *req)
131 req->seq_num = req->smb_conn->signing.next_seq_num;
133 if (req->smb_conn->signing.signing_state != SMB_SIGNING_ENGINE_OFF) {
134 req->smb_conn->signing.next_seq_num += 2;
139 called for requests that do not produce a reply of their own
141 void smbsrv_signing_no_reply(struct smbsrv_request *req)
143 if (req->smb_conn->signing.signing_state != SMB_SIGNING_ENGINE_OFF) {
144 req->smb_conn->signing.next_seq_num--;
148 /***********************************************************
149 SMB signing - Simple implementation - check a MAC sent by client
150 ************************************************************/
152 * Check a packet supplied by the server.
153 * @return False if we had an established signing connection
154 * which had a back checksum, True otherwise
156 BOOL smbsrv_signing_check_incoming(struct smbsrv_request *req)
160 req_signing_alloc_seq_num(req);
162 switch (req->smb_conn->signing.signing_state)
164 case SMB_SIGNING_ENGINE_OFF:
166 case SMB_SIGNING_ENGINE_BSRSPYL:
167 case SMB_SIGNING_ENGINE_ON:
169 if (req->in.size < (HDR_SS_FIELD + 8)) {
172 good = check_signed_incoming_message(&req->in,
173 &req->smb_conn->signing.mac_key,
176 return signing_good(&req->smb_conn->signing,
177 req->seq_num+1, good);