Add a command line option (-S on|off|required) to enable signing on client

connections. Overrides smb.conf parameter if set.
Jeremy.
(This used to be commit 879309671df6b530e0bff69559422a417da4a307)

diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c
index e2fc273479a0280d05df6dcef77c603b96af5952..aacea261febddf86eaa41e47c2bae2feb68a62a3 100644 (file)
--- a/source3/auth/auth_domain.c
+++ b/source3/auth/auth_domain.c
@@ -69,7 +69,7 @@ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli,
        /* Attempt connection */
        *retry = True;
        result = cli_full_connection(cli, global_myname(), dc_name, &dc_ip, 0, 
-               "IPC$", "IPC", "", "", "", 0, retry);
+               "IPC$", "IPC", "", "", "", 0, Undefined, retry);
 
        if (!NT_STATUS_IS_OK(result)) {
                /* map to something more useful */

diff --git a/source3/client/client.c b/source3/client/client.c
index 5319a5ebf5aa027037114e6895c0807967565f45..e17ae82c0a1a61db50010c440c4d363a0bccd2cf 100644 (file)
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -2529,6 +2529,8 @@ static struct cli_state *do_connect(const char *server, const char *share)
 
        c->protocol = max_protocol;
        c->use_kerberos = use_kerberos;
+       cli_setup_signing_state(c, cmdline_auth_info.signing_state);
+               
 
        if (!cli_session_request(c, &calling, &called)) {
                char *p;

diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c
index 68165792da3df3f86f95284d67b0113485aa369f..5daefec5a550f2dd0a8f610b1705f2e437dedfda 100644 (file)
--- a/source3/client/smbspool.c
+++ b/source3/client/smbspool.c
@@ -282,7 +282,7 @@ smb_connect(const char *workgroup,          /* I - Workgroup */
   get_myname(myname);  
        
   nt_status = cli_full_connection(&c, myname, server, NULL, 0, share, "?????", 
-                                 username, workgroup, password, 0, NULL);
+                                 username, workgroup, password, 0, Undefined, NULL);
   
   if (!NT_STATUS_IS_OK(nt_status)) {
          fprintf(stderr, "ERROR:  Connection failed with error %s\n", nt_errstr(nt_status));

diff --git a/source3/include/popt_common.h b/source3/include/popt_common.h
index 57850bf68267e850f49ee61000b24798e70401c4..6db30fbc0acaf27d36b60a236beb1fd691f40b12 100644 (file)
--- a/source3/include/popt_common.h
+++ b/source3/include/popt_common.h
@@ -41,6 +41,7 @@ struct user_auth_info {
        pstring password;
        BOOL got_pass;
        BOOL use_kerberos;
+       int signing_state;
 };
 
 extern struct user_auth_info cmdline_auth_info;

diff --git a/source3/include/smb.h b/source3/include/smb.h
index 6a1d816898efaa6d90b7754989ff75eac3a838bb..deeb61034da3c3eaf9c94f5faabbd2f5f9fb1c73 100644 (file)
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -42,6 +42,7 @@
 #define SMB_PORT2 139
 #define SMB_PORTS "445 139"
 
+#define Undefined (-1)
 #define False (0)
 #define True (1)
 #define Auto (2)

diff --git a/source3/lib/popt_common.c b/source3/lib/popt_common.c
index b8e77b2d9ec2f74ad93879bc8fe8e5038cc0f31f..af1cbcfe80caff856d5a0f76fb3dc1991089237b 100644 (file)
--- a/source3/lib/popt_common.c
+++ b/source3/lib/popt_common.c
@@ -258,19 +258,21 @@ static void get_credentials_file(const char *file, struct user_auth_info *info)
  *             -A,--authentication-file
  *             -k,--use-kerberos
  *             -N,--no-pass
+ *             -S,--signing
  */
 
 
 static void popt_common_credentials_callback(poptContext con, 
-                                                                                        enum poptCallbackReason reason,
-                                                                                        const struct poptOption *opt,
-                                                                                        const char *arg, const void *data)
+                                       enum poptCallbackReason reason,
+                                       const struct poptOption *opt,
+                                       const char *arg, const void *data)
 {
        char *p;
 
        if (reason == POPT_CALLBACK_REASON_PRE) {
                cmdline_auth_info.use_kerberos = False;
                cmdline_auth_info.got_pass = False;
+               cmdline_auth_info.signing_state = Undefined;
                pstrcpy(cmdline_auth_info.username, "GUEST");   
 
                if (getenv("LOGNAME"))pstrcpy(cmdline_auth_info.username,getenv("LOGNAME"));
@@ -327,6 +329,22 @@ static void popt_common_credentials_callback(poptContext con,
                cmdline_auth_info.got_pass = True;
 #endif
                break;
+
+       case 'S':
+               {
+                       cmdline_auth_info.signing_state = -1;
+                       if (strequal(arg, "off") || strequal(arg, "no") || strequal(arg, "false"))
+                               cmdline_auth_info.signing_state = False;
+                       else if (strequal(arg, "on") || strequal(arg, "yes") || strequal(arg, "true"))
+                               cmdline_auth_info.signing_state = True;
+                       else if (strequal(arg, "force") || strequal(arg, "required") || strequal(arg, "forced"))
+                               cmdline_auth_info.signing_state = Required;
+                       else {
+                               fprintf(stderr, "Unknown signing option %s\n", arg );
+                               exit(1);
+                       }
+               }
+               break;
        }
 }
 
@@ -338,5 +356,6 @@ struct poptOption popt_common_credentials[] = {
        { "no-pass", 'N', POPT_ARG_NONE, &cmdline_auth_info.got_pass, 0, "Don't ask for a password" },
        { "kerberos", 'k', POPT_ARG_NONE, &cmdline_auth_info.use_kerberos, 'k', "Use kerberos (active directory) authentication" },
        { "authentication-file", 'A', POPT_ARG_STRING, NULL, 'A', "Get the credentials from a file", "FILE" },
+       { "signing", 'S', POPT_ARG_STRING, NULL, 'S', "Set the client signing state", "on|off|required" },
        POPT_TABLEEND
 };

diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 8873c1fdc82eaf835c8ef40577682487de8018b5..94fe04a480d081db48e1e9b81bacaba275920cf1 100644 (file)
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -995,7 +995,7 @@ BOOL cli_negprot(struct cli_state *cli)
 
        cli->protocol = prots[SVAL(cli->inbuf,smb_vwv0)].prot;  
 
-       if ((cli->protocol < PROTOCOL_NT1) && (lp_client_signing() == Required)) {
+       if ((cli->protocol < PROTOCOL_NT1) && cli->sign_info.mandatory_signing) {
                DEBUG(1,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
                return False;
        }
@@ -1026,7 +1026,7 @@ BOOL cli_negprot(struct cli_state *cli)
 
                if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)) {
                        /* Fail if signing is mandatory and we don't want to support it. */
-                       if (!lp_client_signing()) {
+                       if (!cli->sign_info.allow_smb_signing) {
                                DEBUG(1,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
                                return False;
                        }
@@ -1259,6 +1259,7 @@ NTSTATUS cli_full_connection(struct cli_state **output_cli,
                             const char *service, const char *service_type,
                             const char *user, const char *domain, 
                             const char *password, int flags,
+                            int signing_state,
                             BOOL *retry) 
 {
        struct ntuser_creds creds;
@@ -1321,6 +1322,8 @@ again:
                return NT_STATUS_UNSUCCESSFUL;
        }
 
+       cli_setup_signing_state(cli, signing_state);
+
        if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
                cli->use_spnego = False;
        else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
@@ -1491,7 +1494,7 @@ struct cli_state *get_ipc_connect(char *server, struct in_addr *server_ip,
        
        nt_status = cli_full_connection(&cli, myname, server, server_ip, 0, "IPC$", "IPC", 
                                        user_info->username, lp_workgroup(), user_info->password, 
-                                       CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, NULL);
+                                       CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, Undefined, NULL);
 
        if (NT_STATUS_IS_OK(nt_status)) {
                return cli;

diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c
index cd9edb1cc937f731fb285aae2117a64713f810df..cdda2eb22476a2deba7b20d7d2a7768c0361d67a 100644 (file)
--- a/source3/libsmb/clientgen.c
+++ b/source3/libsmb/clientgen.c
@@ -208,6 +208,27 @@ void cli_init_creds(struct cli_state *cli, const struct ntuser_creds *usr)
                cli->user_name, cli->domain));
 }
 
+/****************************************************************************
+ Set the signing state (used from the command line).
+****************************************************************************/
+
+void cli_setup_signing_state(struct cli_state *cli, int signing_state)
+{
+       if (signing_state == Undefined)
+               return;
+
+       if (signing_state == False) {
+               cli->sign_info.allow_smb_signing = False;
+               cli->sign_info.mandatory_signing = False;
+               return;
+       }
+
+       cli->sign_info.allow_smb_signing = True;
+
+       if (signing_state == Required) 
+               cli->sign_info.mandatory_signing = True;
+}
+
 /****************************************************************************
  Initialise a client structure.
 ****************************************************************************/

diff --git a/source3/libsmb/trusts_util.c b/source3/libsmb/trusts_util.c
index 77e63709aac304a2375c00288d79d3c59ed453b8..610f4b3c03133333719526a80ab6ae51342add66 100644 (file)
--- a/source3/libsmb/trusts_util.c
+++ b/source3/libsmb/trusts_util.c
@@ -154,7 +154,7 @@ BOOL enumerate_domain_trusts( TALLOC_CTX *mem_ctx, const char *domain,
        /* setup the anonymous connection */
 
        result = cli_full_connection( &cli, global_myname(), dc_name, &dc_ip, 0, "IPC$", "IPC",
-               "", "", "", 0, &retry);
+               "", "", "", 0, Undefined, &retry);
        if ( !NT_STATUS_IS_OK(result) )
                goto done;
 

diff --git a/source3/nsswitch/winbindd_cm.c b/source3/nsswitch/winbindd_cm.c
index f9da38660d63d617d3f3174d1f3e274503f6b32a..dbc3062edd6798a04c7c2dd492d751895c4e6b1f 100644 (file)
--- a/source3/nsswitch/winbindd_cm.c
+++ b/source3/nsswitch/winbindd_cm.c
@@ -152,7 +152,8 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index,
                
                result = cli_full_connection(&new_conn->cli, global_myname(), new_conn->controller, 
                                             &dc_ip, 0, "IPC$", "IPC", ipc_username, ipc_domain, 
-                                            ipc_password, CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, &retry);
+                                            ipc_password, CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK,
+                                            Undefined, &retry);
                
                secrets_named_mutex_release(new_conn->controller);
 

diff --git a/source3/python/py_common.c b/source3/python/py_common.c
index ea092d93703b48419e6b2f866c4b591e0a58676c..02d22bbdab56662922601a24ac06b93aaa2d6d3a 100644 (file)
--- a/source3/python/py_common.c
+++ b/source3/python/py_common.c
@@ -223,7 +223,7 @@ struct cli_state *open_pipe_creds(char *server, PyObject *creds,
 
        result = cli_full_connection(
                &cli, NULL, server, NULL, 0, "IPC$", "IPC",
-               username, domain, password, 0, NULL);
+               username, domain, password, 0, Undefined, NULL);
        
        if (!NT_STATUS_IS_OK(result)) {
                *errstr = strdup("error connecting to IPC$ pipe");

diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c
index b4c4d2a9cb11bdf503706117f2e6b3f169a551fe..831d2beaa41f296e213d2f61030fae6a562bdfe7 100644 (file)
--- a/source3/rpcclient/rpcclient.c
+++ b/source3/rpcclient/rpcclient.c
@@ -726,7 +726,8 @@ out_free:
                                        opt_ipaddr ? &server_ip : NULL, 0,
                                        "IPC$", "IPC",  
                                        cmdline_auth_info.username, lp_workgroup(),
-                                       cmdline_auth_info.password, 0, NULL);
+                                       cmdline_auth_info.password, 0,
+                                       cmdline_auth_info.signing_state,NULL);
        
        if (!NT_STATUS_IS_OK(nt_status)) {
                DEBUG(0,("Cannot connect to server.  Error was %s\n", nt_errstr(nt_status)));

diff --git a/source3/smbd/change_trust_pw.c b/source3/smbd/change_trust_pw.c
index 4993e285cac929620d451e69b16edc768c03413d..2eff77b1f708ca1be6cf6c695a945a84ea667e45 100644 (file)
--- a/source3/smbd/change_trust_pw.c
+++ b/source3/smbd/change_trust_pw.c
@@ -58,7 +58,7 @@ NTSTATUS change_trust_account_password( const char *domain, const char *remote_m
                                           NULL, 0,
                                           "IPC$", "IPC",  
                                           "", "",
-                                          "", 0, NULL))) 
+                                          "", 0, Undefined, NULL))) 
        {
                DEBUG(0,("modify_trust_password: Connection to %s failed!\n", remote_machine));
                nt_status = NT_STATUS_UNSUCCESSFUL;

diff --git a/source3/torture/locktest2.c b/source3/torture/locktest2.c
index 29b3c7c4b2f156fb75a29f616afb83a9046bb354..5fbaf9ec584ed8a1259206abc7b6102c0a2f1002 100644 (file)
--- a/source3/torture/locktest2.c
+++ b/source3/torture/locktest2.c
@@ -177,7 +177,7 @@ static struct cli_state *connect_one(char *share)
 
        nt_status = cli_full_connection(&c, myname, server_n, NULL, 0, share, "?????", 
                                        username, lp_workgroup(), password, 0,
-                                       NULL);
+                                       Undefined, NULL);
 
        if (!NT_STATUS_IS_OK(nt_status)) {
                DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status)));

diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 0be79d04a94d430bb20a13fff2ea08661ff4ae40..d20c48d6454682fb1f13740d3fd51d7a60725322 100644 (file)
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -159,7 +159,7 @@ BOOL torture_open_connection(struct cli_state **c)
                                     host, NULL, port_to_use, 
                                     share, "?????", 
                                     username, workgroup, 
-                                    password, flags, &retry);
+                                    password, flags, Undefined, &retry);
        if (!NT_STATUS_IS_OK(status)) {
                return False;
        }
@@ -1128,7 +1128,7 @@ static BOOL run_tcon_devtype_test(int dummy)
                                     host, NULL, port_to_use,
                                     NULL, NULL,
                                     username, workgroup,
-                                    password, flags, &retry);
+                                    password, flags, Undefined, &retry);
 
        if (!NT_STATUS_IS_OK(status)) {
                printf("could not open connection\n");

diff --git a/source3/utils/net.c b/source3/utils/net.c
index a22d34a720139de2553eed99f2c7517ddf409d42..8f6b09a3fa4f7f2329f092e4d3334ae44410a7a9 100644 (file)
--- a/source3/utils/net.c
+++ b/source3/utils/net.c
@@ -141,7 +141,7 @@ NTSTATUS connect_to_ipc(struct cli_state **c, struct in_addr *server_ip,
                                        server_ip, opt_port,
                                        "IPC$", "IPC",  
                                        opt_user_name, opt_workgroup,
-                                       opt_password, 0, NULL);
+                                       opt_password, 0, Undefined, NULL);
        
        if (NT_STATUS_IS_OK(nt_status)) {
                return nt_status;
@@ -171,7 +171,7 @@ NTSTATUS connect_to_ipc_anonymous(struct cli_state **c,
                                        server_ip, opt_port,
                                        "IPC$", "IPC",  
                                        "", "",
-                                       "", 0, NULL);
+                                       "", 0, Undefined, NULL);
        
        if (NT_STATUS_IS_OK(nt_status)) {
                return nt_status;

diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index edf5ec37c2ed7a26041ced6a0e0fa78d48a3b667..631e235127559a6d06c035e5f8ab05da413eab8a 100644 (file)
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -848,7 +848,7 @@ static int net_ads_printer_publish(int argc, const char **argv)
                                        opt_user_name, opt_workgroup,
                                        opt_password ? opt_password : "", 
                                        CLI_FULL_CONNECTION_USE_KERBEROS, 
-                                       NULL);
+                                       Undefined, NULL);
 
        if (NT_STATUS_IS_ERR(nt_status)) {
                d_printf("Unable to open a connnection to %s to obtain data "

diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
index 69dc2dd47a5a6be37a2ccb1bf74c31692b8a6292..c90c042106e531c76a6a228bcffd3efc32dd27f2 100644 (file)
--- a/source3/utils/smbcacls.c
+++ b/source3/utils/smbcacls.c
@@ -724,7 +724,8 @@ static struct cli_state *connect_one(const char *share)
                                                            &ip, 0,
                                                            share, "?????",  
                                                            cmdline_auth_info.username, lp_workgroup(),
-                                                           cmdline_auth_info.password, 0, NULL))) {
+                                                           cmdline_auth_info.password, 0,
+                                                           cmdline_auth_info.signing_state, NULL))) {
                return c;
        } else {
                DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));

diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c
index 9c7379ca2a9c94837213afe270d02cda8fb6d1d8..64321d5bfc3a2c187151583fcc99e4bde55ef029 100644 (file)
--- a/source3/utils/smbcquotas.c
+++ b/source3/utils/smbcquotas.c
@@ -371,7 +371,8 @@ static struct cli_state *connect_one(const char *share)
                                                            &ip, 0,
                                                            share, "?????",  
                                                            cmdline_auth_info.username, lp_workgroup(),
-                                                           cmdline_auth_info.password, 0, NULL))) {
+                                                           cmdline_auth_info.password, 0,
+                                                           cmdline_auth_info.signing_state, NULL))) {
                return c;
        } else {
                DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status)));