added server side SMB2 signing

[ab/samba.git/.git] / source4 / libcli / smb2 / session.c

diff --git a/source4/libcli/smb2/session.c b/source4/libcli/smb2/session.c
index 18fe3486a4d1666f7aa9d240a37928364cf0883c..42fd4840a1ba82268e23620606635028ea379715 100644 (file)
--- a/source4/libcli/smb2/session.c
+++ b/source4/libcli/smb2/session.c
@@ -145,7 +145,7 @@ struct smb2_session_state {
 */
 static void session_request_handler(struct smb2_request *req)
 {
-       struct composite_context *c = talloc_get_type(req->async.private, 
+       struct composite_context *c = talloc_get_type(req->async.private_data, 
                                                      struct composite_context);
        struct smb2_session_state *state = talloc_get_type(c->private_data, 
                                                           struct smb2_session_state);
@@ -164,8 +164,8 @@ static void session_request_handler(struct smb2_request *req)
 
                session_key_err = gensec_session_key(session->gensec, &session_key);
                if (NT_STATUS_IS_OK(session_key_err)) {
-                       session->session_key = session_key;
-               }
+                       session->transport->signing.session_key = session_key;
+               }               
        }
 
        session->uid = state->io.out.uid;
@@ -178,7 +178,7 @@ static void session_request_handler(struct smb2_request *req)
                }
 
                state->req->async.fn = session_request_handler;
-               state->req->async.private = c;
+               state->req->async.private_data = c;
                return;
        }
 
@@ -187,6 +187,16 @@ static void session_request_handler(struct smb2_request *req)
                return;
        }
 
+       if (session->transport->signing.doing_signing) {
+               if (session->transport->signing.session_key.length != 16) {
+                       DEBUG(2,("Wrong session key length %u for SMB2 signing\n",
+                                (unsigned)session->transport->signing.session_key.length));
+                       composite_error(c, NT_STATUS_ACCESS_DENIED);
+                       return;
+               }
+               session->transport->signing.signing_started = true;
+       }
+
        composite_done(c);
 }
 
@@ -208,7 +218,10 @@ struct composite_context *smb2_session_setup_spnego_send(struct smb2_session *se
 
        ZERO_STRUCT(state->io);
        state->io.in.vc_number          = 0;
-       state->io.in.security_mode      = 0;
+       if (session->transport->signing.doing_signing) {
+               state->io.in.security_mode = 
+                       SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED;
+       }
        state->io.in.capabilities       = 0;
        state->io.in.channel            = 0;
        state->io.in.previous_sessionid = 0;