libcli/raw: in SMB_SIGNING_ENGINE_BSRSPYL state copy the client signature, when actin...

metze

diff --git a/source/libcli/raw/smb_signing.c b/source/libcli/raw/smb_signing.c
index 0d71247ecab46fb8406f790e47810a53d0166303..51a6a9db5017a30d480d3f8911fdf3c708b09606 100644 (file)
--- a/source/libcli/raw/smb_signing.c
+++ b/source/libcli/raw/smb_signing.c
@@ -222,6 +222,7 @@ static void smbcli_req_allocate_seq_num(struct smbcli_request *req)
 ************************************************************/
 void smbcli_request_calculate_sign_mac(struct smbcli_request *req)
 {
+       const uint8_t *signature;
 #if 0
        /* enable this when packet signing is preventing you working out why valgrind 
           says that data is uninitialised */
@@ -233,12 +234,21 @@ void smbcli_request_calculate_sign_mac(struct smbcli_request *req)
                break;
 
        case SMB_SIGNING_ENGINE_BSRSPYL:
+               if (req->in.size >= (HDR_SS_FIELD + 8) && req->in.hdr) {
+                       /* as server we just echo the signature from the client */
+                       signature = req->in.hdr + HDR_SS_FIELD;
+               } else {
+                       /*
+                        * I wonder what BSRSPYL stands for - but this is what MS
+                        * actually sends!
+                        */
+                       signature = (const uint8_t *)"BSRSPYL ";
+               }
+
                /* mark the packet as signed - BEFORE we sign it...*/
                mark_packet_signed(&req->out);
-               
-               /* I wonder what BSRSPYL stands for - but this is what MS 
-                  actually sends! */
-               memcpy((req->out.hdr + HDR_SS_FIELD), "BSRSPYL ", 8);
+
+               memcpy((req->out.hdr + HDR_SS_FIELD), signature, 8);
                break;
 
        case SMB_SIGNING_ENGINE_ON: