libcli/smb: maintain smb2.should_sign on smbXcli_req_state

[kai/samba.git] / libcli / smb / smbXcli_base.c

diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index 8458fdeaa6dfb9109486c18430d53fdb11879ef6..8a41824ef96d233aa91099304102e7ebb6830a24 100644 (file)
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -193,7 +193,7 @@ struct smbXcli_req_state {
                const uint8_t *dyn;
                uint32_t dyn_len;
 
-               uint8_t hdr[64];
+               uint8_t hdr[SMB2_HDR_BODY];
                uint8_t pad[7]; /* padding space for compounding */
 
                /*
@@ -206,6 +206,8 @@ struct smbXcli_req_state {
 
                uint16_t credit_charge;
 
+               bool should_sign;
+
                bool signing_skipped;
                bool notify_async;
                bool got_async;
@@ -2412,6 +2414,13 @@ struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
 
        if (session) {
                uid = session->smb2.session_id;
+
+               state->smb2.should_sign = session->smb2.should_sign;
+
+               if (cmd == SMB2_OP_SESSSETUP &&
+                   session->smb2.signing_key.length != 0) {
+                       state->smb2.should_sign = true;
+               }
        }
 
        state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
@@ -2569,18 +2578,11 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
 
 skip_credits:
                if (state->session) {
-                       bool should_sign = state->session->smb2.should_sign;
-
-                       if (opcode == SMB2_OP_SESSSETUP &&
-                           state->session->smb2.signing_key.length != 0) {
-                               should_sign = true;
-                       }
-
                        /*
                         * We prefer the channel signing key if it is
                         * already there.
                         */
-                       if (should_sign) {
+                       if (state->smb2.should_sign) {
                                signing_key = &state->session->smb2.channel_signing_key;
                        }
 
@@ -2760,6 +2762,58 @@ static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
                uint16_t body_size;
                struct iovec *iov_tmp;
 
+               if (len < 4) {
+                       DEBUG(10, ("%d bytes left, expected at least %d\n",
+                                  (int)len, 4));
+                       goto inval;
+               }
+               if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
+                       struct smbXcli_session *s;
+                       uint64_t uid;
+                       struct iovec tf_iov[2];
+                       NTSTATUS status;
+
+                       if (len < SMB2_TF_HDR_SIZE) {
+                               DEBUG(10, ("%d bytes left, expected at least %d\n",
+                                          (int)len, SMB2_TF_HDR_SIZE));
+                               goto inval;
+                       }
+                       tf = hdr;
+                       tf_len = SMB2_TF_HDR_SIZE;
+                       taken += tf_len;
+
+                       hdr = first_hdr + taken;
+                       len = IVAL(tf, SMB2_TF_MSG_SIZE);
+                       uid = BVAL(tf, SMB2_TF_SESSION_ID);
+
+                       s = conn->sessions;
+                       for (; s; s = s->next) {
+                               if (s->smb2.session_id != uid) {
+                                       continue;
+                               }
+                               break;
+                       }
+
+                       if (s == NULL) {
+                               DEBUG(10, ("unknown session_id %llu\n",
+                                          (unsigned long long)uid));
+                               goto inval;
+                       }
+
+                       tf_iov[0].iov_base = (void *)tf;
+                       tf_iov[0].iov_len = tf_len;
+                       tf_iov[1].iov_base = (void *)hdr;
+                       tf_iov[1].iov_len = len;
+
+                       status = smb2_signing_decrypt_pdu(s->smb2.decryption_key,
+                                                         conn->protocol,
+                                                         tf_iov, 2);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               TALLOC_FREE(iov);
+                               return status;
+                       }
+               }
+
                /*
                 * We need the header plus the body length field
                 */
@@ -2791,6 +2845,9 @@ static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
                        if (next_command_ofs > full_size) {
                                goto inval;
                        }
+                       if (tf && next_command_ofs < len) {
+                               goto inval;
+                       }
                        full_size = next_command_ofs;
                }
                if (body_size < 2) {
@@ -2887,7 +2944,6 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                uint32_t new_credits;
                struct smbXcli_session *session = NULL;
                const DATA_BLOB *signing_key = NULL;
-               bool should_sign = false;
 
                new_credits = conn->smb2.cur_credits;
                new_credits += credits;
@@ -2942,15 +2998,7 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                }
                last_session = session;
 
-               if (session) {
-                       should_sign = session->smb2.should_sign;
-                       if (opcode == SMB2_OP_SESSSETUP &&
-                           session->smb2.signing_key.length != 0) {
-                               should_sign = true;
-                       }
-               }
-
-               if (should_sign) {
+               if (state->smb2.should_sign) {
                        if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
                                return NT_STATUS_ACCESS_DENIED;
                        }