s3:smbd: Use smb2_signing_key structure for the decryption key

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source3/librpc/idl/smbXsrv.idl b/source3/librpc/idl/smbXsrv.idl
index f7acb2198fb409e1b9482a08850533c2b68057ab..330c68961141f2f726914e1e56c5c78269f4bfb4 100644 (file)
--- a/source3/librpc/idl/smbXsrv.idl
+++ b/source3/librpc/idl/smbXsrv.idl
@@ -231,6 +231,7 @@ interface smbXsrv
                [noprint] DATA_BLOB                     encryption_key_blob;
                [ignore] smb2_signing_key               *encryption_key;
                [noprint] DATA_BLOB                     decryption_key_blob;
+               [ignore] smb2_signing_key               *decryption_key;
                [noprint] DATA_BLOB                     application_key;
                [range(1, 1024)] uint32                 num_channels;
                smbXsrv_channel_global0                 channels[num_channels];

diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index b708fdb90b91045f55592296806ddc502a39e150..56e7b70696b730482cf1a772bc0d01caaf41d2ec 100644 (file)
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -432,7 +432,7 @@ static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *xconn,
                        tf_iov[1].iov_base = (void *)hdr;
                        tf_iov[1].iov_len = enc_len;
 
-                       status = smb2_signing_decrypt_pdu(s->global->decryption_key_blob,
+                       status = smb2_signing_decrypt_pdu(s->global->decryption_key->blob,
                                                          xconn->smb2.server.cipher,
                                                          tf_iov, 2);
                        if (!NT_STATUS_IS_OK(status)) {

diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
index c2725825d7ab43e7ae1092b1a31077b2d5be7131..d6900665a950bd102aeb606fa6b825de129329dc 100644 (file)
--- a/source3/smbd/smb2_sesssetup.c
+++ b/source3/smbd/smb2_sesssetup.c
@@ -373,18 +373,28 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
        if (xconn->protocol >= PROTOCOL_SMB2_24) {
                struct _derivation *d = &derivation.decryption;
 
-               x->global->decryption_key_blob = data_blob_talloc(x->global,
-                                                            session_key,
-                                                            sizeof(session_key));
-               if (x->global->decryption_key_blob.data == NULL) {
+               x->global->decryption_key =
+                       talloc_zero(x->global, struct smb2_signing_key);
+               if (x->global->decryption_key == NULL) {
+                       ZERO_STRUCT(session_key);
+                       return NT_STATUS_NO_MEMORY;
+               }
+
+               x->global->decryption_key->blob =
+                       x->global->decryption_key_blob =
+                               data_blob_talloc(x->global->decryption_key,
+                                                session_key,
+                                                sizeof(session_key));
+               if (!smb2_signing_key_valid(x->global->decryption_key)) {
                        ZERO_STRUCT(session_key);
                        return NT_STATUS_NO_MEMORY;
                }
+               talloc_keep_secret(x->global->decryption_key->blob.data);
 
                status = smb2_key_derivation(session_key, sizeof(session_key),
                                             d->label.data, d->label.length,
                                             d->context.data, d->context.length,
-                                            x->global->decryption_key_blob.data);
+                                            x->global->decryption_key->blob.data);
                if (!NT_STATUS_IS_OK(status)) {
                        return status;
                }
@@ -484,8 +494,8 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session,
                /* In server code, ServerIn is the decryption key */
 
                DEBUGADD(0, ("ServerIn Key  "));
-               dump_data(0, x->global->decryption_key_blob.data,
-                         x->global->decryption_key_blob.length);
+               dump_data(0, x->global->decryption_key->blob.data,
+                         x->global->decryption_key->blob.length);
                DEBUGADD(0, ("ServerOut Key "));
                dump_data(0, x->global->encryption_key->blob.data,
                          x->global->encryption_key->blob.length);