HACK smbclient anonymous signing and encryption

[metze/samba/wip.git] / libcli / smb / smbXcli_base.c

diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index 444963e2fe1b9063fe89a63f379a6473afad52a2..7db0600dd48b40368d09ae1283fa47db803d1cec 100644 (file)
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -6372,6 +6372,9 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
        DATA_BLOB preauth_hash = data_blob_null;
        size_t nonce_size = 0;
 
+DBG_ERR("_session_key.length[%zu]\n", _session_key.length);
+dump_data(0, _session_key.data, _session_key.length);
+
        if (conn == NULL) {
                return NT_STATUS_INVALID_PARAMETER_MIX;
        }
@@ -6456,6 +6459,7 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
 
        check_signature = conn->mandatory_signing;
 
+       check_signature = false;
        hdr_flags = IVAL(recv_iov[0].iov_base, SMB2_HDR_FLAGS);
        if (hdr_flags & SMB2_HDR_FLAG_SIGNED) {
                /*
@@ -6472,8 +6476,9 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
        }
 
        if (conn->protocol >= PROTOCOL_SMB3_11) {
-               check_signature = true;
+               //check_signature = true;
        }
+               //check_signature = false;
 
        if (check_signature) {
                status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
@@ -6506,6 +6511,7 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
                session->smb2->should_encrypt = false;
        }
 
+               session->smb2->should_sign = check_signature;
        /*
         * CCM and GCM algorithms must never have their
         * nonce wrap, or the security of the whole
@@ -6670,12 +6676,13 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
 
 NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
 {
+       session->smb2->should_sign = true;
        if (!session->smb2->should_sign) {
                /*
                 * We need required signing on the session
                 * in order to prevent man in the middle attacks.
                 */
-               return NT_STATUS_INVALID_PARAMETER_MIX;
+//             return NT_STATUS_INVALID_PARAMETER_MIX;
        }
 
        if (session->smb2->should_encrypt) {