2 Unix SMB/CIFS implementation.
4 Copyright (C) Andrew Tridgell 2004
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "smb_server/smb_server.h"
22 #include "libcli/raw/libcliraw.h"
23 #include "libcli/raw/raw_proto.h"
24 #include "param/param.h"
28 sign an outgoing packet
30 void smbsrv_sign_packet(struct smbsrv_request
*req
)
33 /* enable this when packet signing is preventing you working out why valgrind
34 says that data is uninitialised */
35 file_save("pkt.dat", req
->out
.buffer
, req
->out
.size
);
38 switch (req
->smb_conn
->signing
.signing_state
) {
39 case SMB_SIGNING_ENGINE_OFF
:
42 case SMB_SIGNING_ENGINE_BSRSPYL
:
43 /* mark the packet as signed - BEFORE we sign it...*/
44 mark_packet_signed(&req
->out
);
46 /* I wonder what BSRSPYL stands for - but this is what MS
48 memcpy((req
->out
.hdr
+ HDR_SS_FIELD
), "BSRSPYL ", 8);
51 case SMB_SIGNING_ENGINE_ON
:
53 sign_outgoing_message(&req
->out
,
54 &req
->smb_conn
->signing
.mac_key
,
64 setup the signing key for a connection. Called after authentication succeeds
67 bool smbsrv_setup_signing(struct smbsrv_connection
*smb_conn
,
68 DATA_BLOB
*session_key
,
71 if (!set_smb_signing_common(&smb_conn
->signing
)) {
74 return smbcli_simple_set_signing(smb_conn
,
75 &smb_conn
->signing
, session_key
, response
);
78 bool smbsrv_init_signing(struct smbsrv_connection
*smb_conn
)
80 smb_conn
->signing
.mac_key
= data_blob(NULL
, 0);
81 if (!smbcli_set_signing_off(&smb_conn
->signing
)) {
85 switch (lp_server_signing(smb_conn
->lp_ctx
)) {
87 smb_conn
->signing
.allow_smb_signing
= false;
89 case SMB_SIGNING_SUPPORTED
:
90 smb_conn
->signing
.allow_smb_signing
= true;
92 case SMB_SIGNING_REQUIRED
:
93 smb_conn
->signing
.allow_smb_signing
= true;
94 smb_conn
->signing
.mandatory_signing
= true;
96 case SMB_SIGNING_AUTO
:
97 /* If we are a domain controller, SMB signing is
98 * really important, as it can prevent a number of
99 * attacks on communications between us and the
102 if (lp_server_role(smb_conn
->lp_ctx
) == ROLE_DOMAIN_CONTROLLER
) {
103 smb_conn
->signing
.allow_smb_signing
= true;
104 smb_conn
->signing
.mandatory_signing
= true;
106 /* However, it really sucks (no sendfile, CPU
107 * overhead) performance-wise when used on a
108 * file server, so disable it by default (auto
109 * is the default) on non-DCs */
110 smb_conn
->signing
.allow_smb_signing
= false;
118 allocate a sequence number to a request
120 static void req_signing_alloc_seq_num(struct smbsrv_request
*req
)
122 req
->seq_num
= req
->smb_conn
->signing
.next_seq_num
;
124 if (req
->smb_conn
->signing
.signing_state
!= SMB_SIGNING_ENGINE_OFF
) {
125 req
->smb_conn
->signing
.next_seq_num
+= 2;
130 called for requests that do not produce a reply of their own
132 void smbsrv_signing_no_reply(struct smbsrv_request
*req
)
134 if (req
->smb_conn
->signing
.signing_state
!= SMB_SIGNING_ENGINE_OFF
) {
135 req
->smb_conn
->signing
.next_seq_num
--;
139 /***********************************************************
140 SMB signing - Simple implementation - check a MAC sent by client
141 ************************************************************/
143 * Check a packet supplied by the server.
144 * @return false if we had an established signing connection
145 * which had a back checksum, true otherwise
147 bool smbsrv_signing_check_incoming(struct smbsrv_request
*req
)
151 req_signing_alloc_seq_num(req
);
153 switch (req
->smb_conn
->signing
.signing_state
)
155 case SMB_SIGNING_ENGINE_OFF
:
157 case SMB_SIGNING_ENGINE_BSRSPYL
:
158 case SMB_SIGNING_ENGINE_ON
:
160 if (req
->in
.size
< (HDR_SS_FIELD
+ 8)) {
163 good
= check_signed_incoming_message(&req
->in
,
164 &req
->smb_conn
->signing
.mac_key
,
167 return signing_good(&req
->smb_conn
->signing
,
168 req
->seq_num
+1, good
);