Attachment 9225 Details for Bug 10146 – Additional git-am fix from master for 4.1.0

[patch] Additional git-am fix from master for 4.1.0

0001-libcli-smb-only-check-the-SMB2-session-setup-signatu.patch (text/plain), 2.44 KB, created by Jeremy Allison on 2013-09-18 17:21:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Allison

Created: 2013-09-18 17:21:58 UTC

Size: 2.44 KB

patch

obsolete

>From 4879d0810a2ad741e32ad174a7a14cd35521aeaf Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 18 Sep 2013 02:24:30 +0200
>Subject: [PATCH] libcli/smb: only check the SMB2 session setup signature if
> required and valid
>
>This is an update to commit af290a03cef63c3b08446c1980de064a3b1c8804
>that skips the scary debug messages.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=10146
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>
>Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
>Autobuild-Date(master): Wed Sep 18 04:46:00 CEST 2013 on sn-devel-104
>---
> libcli/smb/smbXcli_base.c | 26 +++++++++++++++++++++-----
> 1 file changed, 21 insertions(+), 5 deletions(-)
>
>diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
>index f59f1f7..27ac2a8 100644
>--- a/libcli/smb/smbXcli_base.c
>+++ b/libcli/smb/smbXcli_base.c
>@@ -4742,12 +4742,18 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
> 	struct smbXcli_conn *conn = session->conn;
> 	uint16_t no_sign_flags;
> 	uint8_t session_key[16];
>+	bool check_signature = true;
>+	uint32_t hdr_flags;
> 	NTSTATUS status;
> 
> 	if (conn == NULL) {
> 		return NT_STATUS_INVALID_PARAMETER_MIX;
> 	}
> 
>+	if (recv_iov[0].iov_len != SMB2_HDR_BODY) {
>+		return NT_STATUS_INVALID_PARAMETER_MIX;
>+	}
>+
> 	no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST | SMB2_SESSION_FLAG_IS_NULL;
> 
> 	if (session->smb2->session_flags & no_sign_flags) {
>@@ -4839,18 +4845,28 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
> 		return NT_STATUS_NO_MEMORY;
> 	}
> 
>-	status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
>-					session->conn->protocol,
>-					recv_iov, 3);
>-	if (!NT_STATUS_IS_OK(status)) {
>+	check_signature = conn->mandatory_signing;
>+
>+	hdr_flags = IVAL(recv_iov[0].iov_base, SMB2_HDR_FLAGS);
>+	if (hdr_flags & SMB2_HDR_FLAG_SIGNED) {
> 		/*
> 		 * Sadly some vendors don't sign the
> 		 * final SMB2 session setup response
> 		 *
> 		 * At least Windows and Samba are always doing this
> 		 * if there's a session key available.
>+		 *
>+		 * We only check the signature if it's mandatory
>+		 * or SMB2_HDR_FLAG_SIGNED is provided.
> 		 */
>-		if (conn->mandatory_signing) {
>+		check_signature = true;
>+	}
>+
>+	if (check_signature) {
>+		status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
>+						session->conn->protocol,
>+						recv_iov, 3);
>+		if (!NT_STATUS_IS_OK(status)) {
> 			return status;
> 		}
> 	}
>-- 
>1.8.1.2
>

Flags:

metze: review+

Actions: View

Attachments on bug 10146: 9220 | 9225 | 9226