[Samba] more logging: Bad SMB2 (sign_algo_id=1) signature for message

Michael Tokarev mjt at tls.msk.ru
Wed Jan 10 13:44:04 UTC 2024


3rd one in one day.

[2024/01/10 16:42:03.713034,  0, pid=2049252] ../../libcli/smb/smb2_signing.c:722(smb2_signing_check_pdu)
   Bad SMB2 (sign_algo_id=1) signature for message
[2024/01/10 16:42:03.713044,  0, pid=2049252] ../../lib/util/util.c:571(dump_data)
   [0000] 73 ED 8B E2 56 72 79 4E   53 7E BE 48 DF EC 07 6E   s...VryN S~.H...n
[2024/01/10 16:42:03.713057,  0, pid=2049252] ../../lib/util/util.c:571(dump_data)
   [0000] C2 81 22 44 50 2B 0B 82   17 DD EB F1 34 68 81 70   .."DP+.. ....4h.p
[2024/01/10 16:42:03.713092,  0, pid=2049252] ../../libcli/smb/smb2_signing.c:722(smb2_signing_check_pdu)
   Bad SMB2 (sign_algo_id=1) signature for message
[2024/01/10 16:42:03.713103,  0, pid=2049252] ../../lib/util/util.c:571(dump_data)
   [0000] 4C 8D 4D E1 14 8A 59 EB   72 40 51 C8 4D FA 43 7F   L.M...Y. r at Q.M.C.
[2024/01/10 16:42:03.713115,  0, pid=2049252] ../../lib/util/util.c:571(dump_data)
   [0000] 55 DB 4D C3 80 C4 AB 57   0A B1 B4 2E 58 BE B7 37   U.M....W ....X..7

repeated *a lot*.

This also shows another big defect of samba logging: there's no context in here,
I can't say which session or client/ip address it is.  So these messages are not
only completely useless but also harmful (because of filling up the logs).

/mjt



More information about the samba mailing list