From 9508c6c3e15a184ba046d61d3195714d9023f370 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 11 Sep 2017 16:36:47 -0700 Subject: [PATCH] libcli: SMB2: NetApps negotiate SMB3_11 but also set the SMB2_CAP_ENCRYPTION flag. This is a SHOULD not, not a MUST not. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13009 Signed-off-by: Jeremy Allison Reviewed-by: Steve French Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Thu Sep 14 14:48:20 CEST 2017 on sn-devel-144 (cherry picked from commit f0a90a1287a8f4c4114919a32afaff52e3c69a9b) --- libcli/smb/smbXcli_base.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c index bf21656..7322380 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c @@ -4921,10 +4921,19 @@ static void smbXcli_negprot_smb2_done(struct tevent_req *subreq) return; } + /* + * Here we are now at SMB3_11, so encryption should be + * negotiated via context, not capabilities. + */ + if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) { - tevent_req_nterror(req, - NT_STATUS_INVALID_NETWORK_RESPONSE); - return; + /* + * Server set SMB2_CAP_ENCRYPTION capability, + * but *SHOULD* not, not *MUST* not. Just mask it off. + * NetApp seems to do this: + * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13009 + */ + conn->smb2.server.capabilities &= ~SMB2_CAP_ENCRYPTION; } negotiate_context_offset = IVAL(body, 60); -- 1.9.1