CVE-2016-2115: s4:libcli/raw: pass the minprotocol to smb_raw_negotiate*()

[samba.git] / source4 / libcli / smb_composite / connect.c

diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c
index 0688684e954ba6b01f50ee7862d18afd8fcc07c0..fffa768ac977c2291dc44a0e0421e49849146f0d 100644 (file)
--- a/source4/libcli/smb_composite/connect.c
+++ b/source4/libcli/smb_composite/connect.c
@@ -31,6 +31,7 @@
 #include "librpc/gen_ndr/ndr_nbt.h"
 #include "param/param.h"
 #include "lib/util/util_net.h"
+#include "libcli/smb/smbXcli_base.h"
 
 /* the stages of this call */
 enum connect_stage {CONNECT_SOCKET, 
@@ -72,6 +73,10 @@ static NTSTATUS connect_tcon(struct composite_context *c,
        status = smb_raw_tcon_recv(state->req, c, state->io_tcon);
        NT_STATUS_NOT_OK_RETURN(status);
 
+       if (state->io_tcon->tconx.out.options & SMB_EXTENDED_SIGNATURES) {
+               smb1cli_session_protect_session_key(io->out.tree->session->smbXcli);
+       }
+
        io->out.tree->tid = state->io_tcon->tconx.out.tid;
        if (state->io_tcon->tconx.out.dev_type) {
                io->out.tree->device = talloc_strdup(io->out.tree, 
@@ -110,7 +115,7 @@ static NTSTATUS connect_session_setup_anon(struct composite_context *c,
 
        /* connect to a share using a tree connect */
        state->io_tcon->generic.level = RAW_TCON_TCONX;
-       state->io_tcon->tconx.in.flags = 0;
+       state->io_tcon->tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
        state->io_tcon->tconx.in.password = data_blob(NULL, 0); 
        
        state->io_tcon->tconx.in.path = talloc_asprintf(state->io_tcon, 
@@ -163,7 +168,6 @@ static NTSTATUS connect_session_setup(struct composite_context *c,
                 * have been given a uid in the NTLMSSP_CHALLENGE reply. This
                 * would lead to an invalid uid in the anonymous fallback */
                state->session->vuid = 0;
-               data_blob_free(&state->session->user_session_key);
                talloc_free(state->session->gensec);
                state->session->gensec = NULL;
 
@@ -196,7 +200,8 @@ static NTSTATUS connect_session_setup(struct composite_context *c,
 
        /* connect to a share using a tree connect */
        state->io_tcon->generic.level = RAW_TCON_TCONX;
-       state->io_tcon->tconx.in.flags = 0;
+       state->io_tcon->tconx.in.flags = TCONX_FLAG_EXTENDED_RESPONSE;
+       state->io_tcon->tconx.in.flags |= TCONX_FLAG_EXTENDED_SIGNATURES;
        state->io_tcon->tconx.in.password = data_blob(NULL, 0); 
        
        state->io_tcon->tconx.in.path = talloc_asprintf(state->io_tcon, 
@@ -292,7 +297,8 @@ static NTSTATUS connect_send_negprot(struct composite_context *c,
        state->subreq = smb_raw_negotiate_send(state,
                                               state->transport->ev,
                                               state->transport,
-                                              io->in.options.max_protocol);
+                                              state->transport->options.min_protocol,
+                                              state->transport->options.max_protocol);
        NT_STATUS_HAVE_NO_MEMORY(state->subreq);
        tevent_req_set_callback(state->subreq, subreq_handler, c);
        state->stage = CONNECT_NEGPROT;