From bfdffea0fa8e6af57c2b3e51472bab46d46fbaca Mon Sep 17 00:00:00 2001 From: Ralph Boehme Date: Mon, 9 Nov 2015 17:23:29 +0100 Subject: [PATCH] s3:smb2_server: convert encryption desired and required bools to flags This adds a bitmap smbXsrv_encrpytion_flags with flags to the smbXsrv_session_global.tdb and smbXsrv_tcon_global.tdb that we use instead of bools for desired and required. We need this info in the smbXsrv tdbs for smbstatus. Subsequent commits for smbstatus will use it. Signed-off-by: Ralph Boehme Reviewed-by: Volker Lendecke Reviewed-by: Jeremy Allison --- source3/librpc/idl/smbXsrv.idl | 11 +++++++---- source3/smbd/smb2_server.c | 12 ++++++------ source3/smbd/smb2_sesssetup.c | 12 ++++++------ source3/smbd/smb2_tcon.c | 12 ++++++++---- 4 files changed, 27 insertions(+), 20 deletions(-) diff --git a/source3/librpc/idl/smbXsrv.idl b/source3/librpc/idl/smbXsrv.idl index 4062610baa8..ab4937e43f3 100644 --- a/source3/librpc/idl/smbXsrv.idl +++ b/source3/librpc/idl/smbXsrv.idl @@ -116,6 +116,11 @@ interface smbXsrv /* sessions */ + typedef [public,bitmap8bit] bitmap { + SMBXSRV_ENCRYPTION_REQUIRED = 0x01, + SMBXSRV_ENCRYPTION_DESIRED = 0x02 + } smbXsrv_encrpytion_flags; + typedef struct { server_id server_id; [charset(UTF8),string] char local_address[]; @@ -141,7 +146,7 @@ interface smbXsrv auth_session_info *auth_session_info; uint16 connection_dialect; boolean8 signing_required; - boolean8 encryption_required; + smbXsrv_encrpytion_flags encryption_flags; [noprint] DATA_BLOB signing_key; [noprint] DATA_BLOB encryption_key; [noprint] DATA_BLOB decryption_key; @@ -206,7 +211,6 @@ interface smbXsrv [ignore] user_struct *compat; [ignore] smbXsrv_tcon_table *tcon_table; smbXsrv_session_auth0 *pending_auth; - boolean8 encryption_desired; } smbXsrv_session; typedef union { @@ -259,7 +263,7 @@ interface smbXsrv server_id server_id; NTTIME creation_time; [charset(UTF8),string] char share_name[]; - boolean8 encryption_required; + smbXsrv_encrpytion_flags encryption_flags; /* * for SMB1 this is the session that the tcon was opened on */ @@ -301,7 +305,6 @@ interface smbXsrv NTSTATUS status; NTTIME idle_time; [ignore] connection_struct *compat; - boolean8 encryption_desired; } smbXsrv_tcon; typedef union { diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index cdcead0dbce..bd8261a153f 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -2067,8 +2067,8 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) x = req->session; if (x != NULL) { signing_required = x->global->signing_required; - encryption_desired = x->encryption_desired; - encryption_required = x->global->encryption_required; + encryption_desired = x->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED; + encryption_required = x->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED; } req->do_signing = false; @@ -2224,10 +2224,10 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) if (!NT_STATUS_IS_OK(status)) { return smbd_smb2_request_error(req, status); } - if (req->tcon->encryption_desired) { + if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) { encryption_desired = true; } - if (req->tcon->global->encryption_required) { + if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED) { encryption_required = true; } if (encryption_required && !req->was_encrypted) { @@ -2882,8 +2882,8 @@ static NTSTATUS smbd_smb2_send_break(struct smbXsrv_connection *xconn, if (session != NULL) { session_wire_id = session->global->session_wire_id; - do_encryption = session->encryption_desired; - if (tcon->encryption_desired) { + do_encryption = session->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED; + if (tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) { do_encryption = true; } } diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c index 30e2d7fccfa..eb1c3b5258d 100644 --- a/source3/smbd/smb2_sesssetup.c +++ b/source3/smbd/smb2_sesssetup.c @@ -268,12 +268,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { - x->encryption_desired = true; + x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; } if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { - x->encryption_desired = true; - x->global->encryption_required = true; + x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | + SMBXSRV_ENCRYPTION_DESIRED; } if (security_session_user_level(session_info, NULL) < SECURITY_USER) { @@ -285,13 +285,13 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, guest = true; } - if (guest && x->global->encryption_required) { + if (guest && (x->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED)) { DEBUG(1,("reject guest session as encryption is required\n")); return NT_STATUS_ACCESS_DENIED; } if (xconn->smb2.server.cipher == 0) { - if (x->global->encryption_required) { + if (x->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED) { DEBUG(1,("reject session with dialect[0x%04X] " "as encryption is required\n", xconn->smb2.server.dialect)); @@ -299,7 +299,7 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, } } - if (x->encryption_desired) { + if (x->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) { *out_session_flags |= SMB2_SESSION_FLAG_ENCRYPT_DATA; } diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c index 99e2f215ca4..61e2a3636d3 100644 --- a/source3/smbd/smb2_tcon.c +++ b/source3/smbd/smb2_tcon.c @@ -193,8 +193,8 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, connection_struct *compat_conn = NULL; struct user_struct *compat_vuser = req->session->compat; NTSTATUS status; - bool encryption_desired = req->session->encryption_desired; - bool encryption_required = req->session->global->encryption_required; + bool encryption_desired = req->session->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED; + bool encryption_required = req->session->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED; bool guest_session = false; bool require_signed_tcon = false; @@ -298,8 +298,12 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, return status; } - tcon->encryption_desired = encryption_desired; - tcon->global->encryption_required = encryption_required; + if (encryption_desired) { + tcon->global->encryption_flags |= SMBXSRV_ENCRYPTION_DESIRED; + } + if (encryption_required) { + tcon->global->encryption_flags |= SMBXSRV_ENCRYPTION_REQUIRED; + } compat_conn = make_connection_smb2(req, tcon, snum, -- 2.11.4.GIT