[SCM] Samba Shared Repository - branch master updated - release-4-0-0alpha7-671-g97a086d

Stefan Metzmacher metze at samba.org
Mon Mar 23 11:50:51 GMT 2009


The branch, master has been updated
       via  97a086d5c4e84616065cbbc68d47d82de0fe0db5 (commit)
       via  6af15943c6f868d08945d0ca993506c17107fbd4 (commit)
       via  c16c90a1cb3b0e2ceadd3dea835a4e69acfc2fae (commit)
       via  2654653f55ed5744cc9fca6a79127386f55425e1 (commit)
       via  1a48d0793b9d3a76aff76580661626e5cd95f427 (commit)
      from  7716ad68a8d859ac3651c4eb559b6e45d98566db (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 97a086d5c4e84616065cbbc68d47d82de0fe0db5
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Mar 6 16:35:34 2009 +0100

    selftest/Samba3: Test smb signing against the member server
    
    metze

commit 6af15943c6f868d08945d0ca993506c17107fbd4
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Mar 9 09:50:36 2009 +0100

    s3:libsmb: use new simplified smb_signing code for the client side
    
    We store the seqnum/mid mapping in the cli_request structure
    for async requests and in the cli_state structure for sync calls.
    
    We skip the signing check for oplock requests while waiting
    for async requests coming in.
    
    metze

commit c16c90a1cb3b0e2ceadd3dea835a4e69acfc2fae
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Mar 9 09:47:59 2009 +0100

    s3:smbd: use new simplified snb_signing code in the server
    
    We keep the seqnum/mid mapping in the smb_request structure.
    
    This also moves one global variable into the
    smbd_server_connection struct.
    
    metze

commit 2654653f55ed5744cc9fca6a79127386f55425e1
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Mar 9 08:42:05 2009 +0100

    s3:libsmb: add a much simplified smb_siging infrastructure
    
    It's the job of the caller to maintain the seqnum/mid mapping.
    
    Hopefully we can use this code in s4 later too.
    
    metze

commit 1a48d0793b9d3a76aff76580661626e5cd95f427
Author: Stefan Metzmacher <metze at samba.org>
Date:   Sun Mar 8 17:47:08 2009 +0100

    s3:libsmb: rename smb_signing.c => clisigning.c
    
    This prepares a large simplification of the smb_signing code
    
    metze

-----------------------------------------------------------------------

Summary of changes:
 selftest/target/Samba3.pm     |    1 +
 source3/Makefile.in           |    5 +-
 source3/include/async_smb.h   |    2 +
 source3/include/client.h      |   10 +-
 source3/include/includes.h    |    1 +
 source3/include/proto.h       |   49 ++-
 source3/include/smb.h         |   17 +-
 source3/include/smb_signing.h |   46 ++
 source3/libsmb/async_smb.c    |   43 ++-
 source3/libsmb/cliconnect.c   |   39 +-
 source3/libsmb/clientgen.c    |  104 ++++-
 source3/libsmb/clisigning.c   |   87 ++++
 source3/libsmb/clitrans.c     |   54 ++-
 source3/libsmb/smb_signing.c  | 1020 ++++++++---------------------------------
 source3/param/loadparm.c      |   11 +-
 source3/selftest/tests.sh     |    4 +
 source3/smbd/aio.c            |   13 +-
 source3/smbd/blocking.c       |    5 +-
 source3/smbd/globals.h        |    1 +
 source3/smbd/ipc.c            |    4 +
 source3/smbd/negprot.c        |    2 +-
 source3/smbd/notify.c         |    7 +-
 source3/smbd/nttrans.c        |    3 +-
 source3/smbd/open.c           |    9 -
 source3/smbd/oplock.c         |   27 +-
 source3/smbd/password.c       |    8 +-
 source3/smbd/pipes.c          |    1 +
 source3/smbd/process.c        |   50 ++-
 source3/smbd/reply.c          |   24 +-
 source3/smbd/service.c        |    2 +-
 source3/smbd/sesssetup.c      |   25 -
 source3/smbd/signing.c        |  158 +++++++
 source3/smbd/trans2.c         |    5 +-
 33 files changed, 796 insertions(+), 1041 deletions(-)
 create mode 100644 source3/include/smb_signing.h
 create mode 100644 source3/libsmb/clisigning.c
 create mode 100644 source3/smbd/signing.c


Changeset truncated at 500 lines:

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 78aafa7..0b176d6 100644
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -144,6 +144,7 @@ sub setup_member($$$)
 
 	my $member_options = "
 	security = domain
+	server signing = on
 ";
 	my $ret = $self->provision($prefix,
 				   "LOCALMEMBER3",
diff --git a/source3/Makefile.in b/source3/Makefile.in
index 49cf840..46216c7 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -364,7 +364,8 @@ LIB_OBJ = $(LIBSAMBAUTIL_OBJ) $(UTIL_OBJ) $(CRYPTO_OBJ) \
 	  lib/util.o lib/util_sock.o lib/sock_exec.o lib/util_sec.o \
 	  lib/substitute.o lib/dbwrap_util.o \
 	  lib/ms_fnmatch.o lib/select.o lib/errmap_unix.o \
-	  lib/tallocmsg.o lib/dmallocmsg.o libsmb/smb_signing.o \
+	  lib/tallocmsg.o lib/dmallocmsg.o \
+	  libsmb/clisigning.o libsmb/smb_signing.o \
 	  lib/iconv.o lib/pam_errors.o intl/lang_tdb.o \
 	  lib/conn_tdb.o lib/adt_tree.o lib/gencache.o \
 	  lib/module.o lib/events.o @LIBTEVENT_OBJ0@ \
@@ -732,7 +733,7 @@ SMBD_OBJ_SRV = smbd/files.o smbd/chgpasswd.o smbd/connection.o \
 	       smbd/change_trust_pw.o smbd/fake_file.o \
 	       smbd/quotas.o smbd/ntquotas.o $(AFS_OBJ) smbd/msdfs.o \
 	       $(AFS_SETTOKEN_OBJ) smbd/aio.o smbd/statvfs.o \
-	       smbd/dmapi.o \
+	       smbd/dmapi.o smbd/signing.o \
 	       smbd/file_access.o \
 	       smbd/dnsregister.o smbd/globals.o \
 	       $(MANGLE_OBJ) @VFS_STATIC@
diff --git a/source3/include/async_smb.h b/source3/include/async_smb.h
index 7fc4ff7..2ac1101 100644
--- a/source3/include/async_smb.h
+++ b/source3/include/async_smb.h
@@ -63,6 +63,8 @@ struct cli_request {
 	 */
 	uint16_t mid;
 
+	uint32_t seqnum;
+
 	/**
 	 * The bytes we have to ship to the server
 	 */
diff --git a/source3/include/client.h b/source3/include/client.h
index 320a90e..db19f34 100644
--- a/source3/include/client.h
+++ b/source3/include/client.h
@@ -166,6 +166,13 @@ struct smb_trans_enc_state {
         } s;
 };
 
+struct cli_state_seqnum {
+	struct cli_state_seqnum *prev, *next;
+	uint16_t mid;
+	uint32_t seqnum;
+	bool persistent;
+};
+
 struct cli_state {
 	/**
 	 * A list of subsidiary connections for DFS.
@@ -217,6 +224,7 @@ struct cli_state {
 	size_t max_xmit;
 	size_t max_mux;
 	char *outbuf;
+	struct cli_state_seqnum *seqnum;
 	char *inbuf;
 	unsigned int bufsize;
 	int initialised;
@@ -231,7 +239,7 @@ struct cli_state {
 	TALLOC_CTX *call_mem_ctx;
 #endif
 
-	smb_sign_info sign_info;
+	struct smb_signing_state *signing_state;
 
 	struct smb_trans_enc_state *trans_enc_state; /* Setup if we're encrypting SMB's. */
 
diff --git a/source3/include/includes.h b/source3/include/includes.h
index 4bf4b5c..c883e17 100644
--- a/source3/include/includes.h
+++ b/source3/include/includes.h
@@ -598,6 +598,7 @@ struct smb_iconv_convenience *lp_iconv_convenience(void *lp_ctx);
 #include "messages.h"
 #include "locking.h"
 #include "smb_perfcount.h"
+#include "smb_signing.h"
 #include "smb.h"
 #include "nameserv.h"
 #include "secrets.h"
diff --git a/source3/include/proto.h b/source3/include/proto.h
index c84b1cb..d93c4a5 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -2410,6 +2410,10 @@ bool receive_getdc_response(TALLOC_CTX *mem_ctx,
 int cli_set_message(char *buf,int num_words,int num_bytes,bool zero);
 unsigned int cli_set_timeout(struct cli_state *cli, unsigned int timeout);
 void cli_set_port(struct cli_state *cli, int port);
+bool cli_state_seqnum_persistent(struct cli_state *cli,
+				 uint16_t mid);
+bool cli_state_seqnum_remove(struct cli_state *cli,
+			     uint16_t mid);
 bool cli_receive_smb(struct cli_state *cli);
 ssize_t cli_receive_smb_data(struct cli_state *cli, char *buffer, size_t len);
 bool cli_receive_smb_readX_header(struct cli_state *cli);
@@ -3181,29 +3185,34 @@ void cli_free_enc_buffer(struct cli_state *cli, char *buf);
 NTSTATUS cli_decrypt_message(struct cli_state *cli);
 NTSTATUS cli_encrypt_message(struct cli_state *cli, char *buf, char **buf_out);
 
-/* The following definitions come from libsmb/smb_signing.c  */
+/* The following definitions come from libsmb/clisigning.c  */
 
 bool cli_simple_set_signing(struct cli_state *cli,
 			    const DATA_BLOB user_session_key,
 			    const DATA_BLOB response);
-bool cli_null_set_signing(struct cli_state *cli);
 bool cli_temp_set_signing(struct cli_state *cli);
-void cli_free_signing_context(struct cli_state *cli);
-void cli_calculate_sign_mac(struct cli_state *cli, char *buf);
-bool cli_check_sign_mac(struct cli_state *cli, char *buf);
-bool client_set_trans_sign_state_on(struct cli_state *cli, uint16 mid);
-bool client_set_trans_sign_state_off(struct cli_state *cli, uint16 mid);
+void cli_calculate_sign_mac(struct cli_state *cli, char *buf, uint32_t *seqnum);
+bool cli_check_sign_mac(struct cli_state *cli, const char *buf, uint32_t seqnum);
 bool client_is_signing_on(struct cli_state *cli);
-bool srv_oplock_set_signing(bool onoff);
-bool srv_check_sign_mac(const char *inbuf, bool must_be_ok);
-void srv_calculate_sign_mac(char *outbuf);
-void srv_defer_sign_response(uint16 mid);
-void srv_cancel_sign_response(uint16 mid, bool cancel);
-void srv_set_signing_negotiated(void);
-bool srv_is_signing_active(void);
-bool srv_is_signing_negotiated(void);
-bool srv_signing_started(void);
-void srv_set_signing(const DATA_BLOB user_session_key, const DATA_BLOB response);
+bool client_is_signing_allowed(struct cli_state *cli);
+bool client_is_signing_mandatory(struct cli_state *cli);
+void cli_set_signing_negotiated(struct cli_state *cli);
+
+/* The following definitions come from smbd/signing.c  */
+
+struct smbd_server_connection;
+bool srv_check_sign_mac(struct smbd_server_connection *conn,
+			const char *inbuf, uint32_t *seqnum);
+void srv_calculate_sign_mac(struct smbd_server_connection *conn,
+			    char *outbuf, uint32_t seqnum);
+void srv_cancel_sign_response(struct smbd_server_connection *conn);
+bool srv_init_signing(struct smbd_server_connection *conn);
+void srv_set_signing_negotiated(struct smbd_server_connection *conn);
+bool srv_is_signing_active(struct smbd_server_connection *conn);
+bool srv_is_signing_negotiated(struct smbd_server_connection *conn);
+void srv_set_signing(struct smbd_server_connection *conn,
+		     const DATA_BLOB user_session_key,
+		     const DATA_BLOB response);
 
 /* The following definitions come from libsmb/smbdes.c  */
 
@@ -4347,7 +4356,7 @@ const char *lp_printcapname(void);
 bool lp_disable_spoolss( void );
 void lp_set_spoolss_state( uint32 state );
 uint32 lp_get_spoolss_state( void );
-bool lp_use_sendfile(int snum);
+bool lp_use_sendfile(int snum, struct smb_signing_state *signing_state);
 void set_use_sendfile(int snum, bool val);
 void set_store_dos_attributes(int snum, bool val);
 void lp_set_mangling_method(const char *new_method);
@@ -6722,7 +6731,9 @@ SEC_DESC *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname);
 
 void smbd_setup_sig_term_handler(void);
 void smbd_setup_sig_hup_handler(void);
-bool srv_send_smb(int fd, char *buffer, bool do_encrypt,
+bool srv_send_smb(int fd, char *buffer,
+		  bool no_signing, uint32_t seqnum,
+		  bool do_encrypt,
 		  struct smb_perfcount_data *pcd);
 int srv_set_message(char *buf,
                         int num_words,
diff --git a/source3/include/smb.h b/source3/include/smb.h
index 281a218..84aa36a 100644
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -621,6 +621,7 @@ struct smb_request {
 	uint16 flags2;
 	uint16 smbpid;
 	uint16 mid;
+	uint32_t seqnum;
 	uint16 vuid;
 	uint16 tid;
 	uint8  wct;
@@ -722,6 +723,7 @@ struct pending_message_list {
 	struct timeval request_time; /* When was this first issued? */
 	struct timed_event *te;
 	struct smb_perfcount_data pcd;
+	uint32_t seqnum;
 	bool encrypted;
 	DATA_BLOB buf;
 	DATA_BLOB private_data;
@@ -1847,21 +1849,6 @@ struct ip_service {
 /* Special name type used to cause a _kerberos DNS lookup. */
 #define KDC_NAME_TYPE 0xDCDC
 
-/* Used by the SMB signing functions. */
-
-typedef struct smb_sign_info {
-	void (*sign_outgoing_message)(char *outbuf, struct smb_sign_info *si);
-	bool (*check_incoming_message)(const char *inbuf, struct smb_sign_info *si, bool must_be_ok);
-	void (*free_signing_context)(struct smb_sign_info *si);
-	void *signing_context;
-
-	bool negotiated_smb_signing;
-	bool allow_smb_signing;
-	bool doing_signing;
-	bool mandatory_signing;
-	bool seen_valid; /* Have I ever seen a validly signed packet? */
-} smb_sign_info;
-
 struct ea_struct {
 	uint8 flags;
 	char *name;
diff --git a/source3/include/smb_signing.h b/source3/include/smb_signing.h
new file mode 100644
index 0000000..770c40c
--- /dev/null
+++ b/source3/include/smb_signing.h
@@ -0,0 +1,46 @@
+/*
+   Unix SMB/CIFS implementation.
+   SMB Signing Code
+   Copyright (C) Jeremy Allison 2003.
+   Copyright (C) Andrew Bartlett <abartlet at samba.org> 2002-2003
+   Copyright (C) Stefan Metzmacher 2009
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _SMB_SIGNING_H_
+#define _SMB_SIGNING_H_
+
+struct smb_signing_state;
+
+struct smb_signing_state *smb_signing_init(TALLOC_CTX *mem_ctx,
+					   bool allowed,
+					   bool mandatory);
+uint32_t smb_signing_next_seqnum(struct smb_signing_state *si, bool oneway);
+void smb_signing_cancel_reply(struct smb_signing_state *si, bool oneway);
+void smb_signing_sign_pdu(struct smb_signing_state *si,
+			  uint8_t *outbuf, uint32_t seqnum);
+bool smb_signing_check_pdu(struct smb_signing_state *si,
+			   const uint8_t *inbuf, uint32_t seqnum);
+bool smb_signing_set_bsrspyl(struct smb_signing_state *si);
+bool smb_signing_activate(struct smb_signing_state *si,
+			  const DATA_BLOB user_session_key,
+			  const DATA_BLOB response);
+bool smb_signing_is_active(struct smb_signing_state *si);
+bool smb_signing_is_allowed(struct smb_signing_state *si);
+bool smb_signing_is_mandatory(struct smb_signing_state *si);
+bool smb_signing_set_negotiated(struct smb_signing_state *si);
+bool smb_signing_is_negotiated(struct smb_signing_state *si);
+
+#endif /* _SMB_SIGNING_H_ */
diff --git a/source3/libsmb/async_smb.c b/source3/libsmb/async_smb.c
index 066ac7b..86fd5c8 100644
--- a/source3/libsmb/async_smb.c
+++ b/source3/libsmb/async_smb.c
@@ -550,7 +550,7 @@ void cli_chain_uncork(struct cli_state *cli)
 		_smb_setlen_large(((char *)req->outbuf), smblen);
 	}
 
-	cli_calculate_sign_mac(cli, (char *)req->outbuf);
+	cli_calculate_sign_mac(cli, (char *)req->outbuf, &req->seqnum);
 
 	if (cli_encryption_on(cli)) {
 		NTSTATUS status;
@@ -811,9 +811,16 @@ NTSTATUS cli_pull_reply(struct async_req *req,
  */
 
 
-static NTSTATUS validate_smb_crypto(struct cli_state *cli, char *pdu)
+static NTSTATUS validate_smb_crypto(struct cli_state *cli, char *pdu,
+				    struct cli_request **_req,
+				    uint16_t *_mid)
 {
 	NTSTATUS status;
+	struct cli_request *req = NULL;
+	uint16_t mid;
+
+	*_req = NULL;
+	*_mid = 0;
 
 	if ((IVAL(pdu, 4) != 0x424d53ff) /* 0xFF"SMB" */
 	    && (SVAL(pdu, 4) != 0x45ff)) /* 0xFF"E" */ {
@@ -846,11 +853,27 @@ static NTSTATUS validate_smb_crypto(struct cli_state *cli, char *pdu)
 		}
 	}
 
-	if (!cli_check_sign_mac(cli, pdu)) {
+	mid = SVAL(pdu, smb_mid);
+
+	for (req = cli->outstanding_requests; req; req = req->next) {
+		if (req->mid == mid) {
+			break;
+		}
+	}
+
+	if (!req) {
+		/* oplock breaks are not signed */
+		goto done;
+	}
+
+	if (!cli_check_sign_mac(cli, pdu, req->seqnum+1)) {
 		DEBUG(10, ("cli_check_sign_mac failed\n"));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
+done:
+	*_req = req;
+	*_mid = mid;
 	return NT_STATUS_OK;
 }
 
@@ -863,7 +886,7 @@ static void handle_incoming_pdu(struct cli_state *cli)
 {
 	struct cli_request *req, *next;
 	uint16_t mid;
-	size_t raw_pdu_len, buf_len, pdu_len, rest_len;
+	size_t raw_pdu_len, buf_len, rest_len;
 	char *pdu;
 	int i;
 	NTSTATUS status;
@@ -923,23 +946,13 @@ static void handle_incoming_pdu(struct cli_state *cli)
 		}
 	}
 
-	status = validate_smb_crypto(cli, pdu);
+	status = validate_smb_crypto(cli, pdu, &req, &mid);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto invalidate_requests;
 	}
 
-	mid = SVAL(pdu, smb_mid);
-
 	DEBUG(10, ("handle_incoming_pdu: got mid %d\n", mid));
 
-	for (req = cli->outstanding_requests; req; req = req->next) {
-		if (req->mid == mid) {
-			break;
-		}
-	}
-
-	pdu_len = smb_len(pdu) + 4;
-
 	if (req == NULL) {
 		DEBUG(3, ("Request for mid %d not found, dumping PDU\n", mid));
 
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 525c361..aa1ca59 100644
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -505,11 +505,7 @@ static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
 	ok = cli_simple_set_signing(cli, session_key, nt_response);
 #endif
 	if (ok) {
-		/* 'resign' the last message, so we get the right sequence numbers
-		   for checking the first reply from the server */
-		cli_calculate_sign_mac(cli, cli->outbuf);
-
-		if (!cli_check_sign_mac(cli, cli->inbuf)) {
+		if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 			result = NT_STATUS_ACCESS_DENIED;
 			goto end;
 		}
@@ -747,11 +743,7 @@ static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *
 	if (cli_simple_set_signing(
 		    cli, session_key_krb5, data_blob_null)) {
 
-		/* 'resign' the last message, so we get the right sequence numbers
-		   for checking the first reply from the server */
-		cli_calculate_sign_mac(cli, cli->outbuf);
-
-		if (!cli_check_sign_mac(cli, cli->inbuf)) {
+		if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 			nt_status = NT_STATUS_ACCESS_DENIED;
 			goto nt_error;
 		}
@@ -873,11 +865,7 @@ static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *use
 		if (cli_simple_set_signing(
 			    cli, ntlmssp_state->session_key, data_blob_null)) {
 
-			/* 'resign' the last message, so we get the right sequence numbers
-			   for checking the first reply from the server */
-			cli_calculate_sign_mac(cli, cli->outbuf);
-
-			if (!cli_check_sign_mac(cli, cli->inbuf)) {
+			if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 				nt_status = NT_STATUS_ACCESS_DENIED;
 			}
 		}
@@ -1540,13 +1528,16 @@ NTSTATUS cli_negprot_recv(struct async_req *req)
 
 	cli->protocol = prots[protnum].prot;
 
-	if ((cli->protocol < PROTOCOL_NT1) && cli->sign_info.mandatory_signing) {
+	if ((cli->protocol < PROTOCOL_NT1) &&
+	    client_is_signing_mandatory(cli)) {
 		DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
 	if (cli->protocol >= PROTOCOL_NT1) {    
 		struct timespec ts;
+		bool negotiated_smb_signing = false;
+
 		/* NT protocol */
 		cli->sec_mode = CVAL(vwv + 1, 0);
 		cli->max_mux = SVAL(vwv + 1, 1);
@@ -1579,22 +1570,24 @@ NTSTATUS cli_negprot_recv(struct async_req *req)
 
 		if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
 			/* Fail if server says signing is mandatory and we don't want to support it. */
-			if (!cli->sign_info.allow_smb_signing) {
+			if (!client_is_signing_allowed(cli)) {
 				DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
 				return NT_STATUS_ACCESS_DENIED;
 			}
-			cli->sign_info.negotiated_smb_signing = True;
-			cli->sign_info.mandatory_signing = True;
-		} else if (cli->sign_info.mandatory_signing && cli->sign_info.allow_smb_signing) {
+			negotiated_smb_signing = true;
+		} else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
 			/* Fail if client says signing is mandatory and the server doesn't support it. */
 			if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
 				DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
 				return NT_STATUS_ACCESS_DENIED;
 			}
-			cli->sign_info.negotiated_smb_signing = True;
-			cli->sign_info.mandatory_signing = True;
+			negotiated_smb_signing = true;
 		} else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
-			cli->sign_info.negotiated_smb_signing = True;
+			negotiated_smb_signing = true;
+		}
+
+		if (negotiated_smb_signing) {
+			cli_set_signing_negotiated(cli);
 		}
 
 		if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c
index c1ba4e5..6186387 100644
--- a/source3/libsmb/clientgen.c
+++ b/source3/libsmb/clientgen.c
@@ -135,6 +135,79 @@ static ssize_t client_receive_smb(struct cli_state *cli, size_t maxlen)
 	return len;
 }
 
+static bool cli_state_set_seqnum(struct cli_state *cli, uint16_t mid, uint32_t seqnum)
+{
+	struct cli_state_seqnum *c;
+
+	for (c = cli->seqnum; c; c = c->next) {
+		if (c->mid == mid) {
+			c->seqnum = seqnum;
+			return true;
+		}
+	}
+
+	c = talloc_zero(cli, struct cli_state_seqnum);
+	if (!c) {
+		return false;
+	}
+
+	c->mid = mid;
+	c->seqnum = seqnum;
+	c->persistent = false;
+	DLIST_ADD_END(cli->seqnum, c, struct cli_state_seqnum *);
+
+	return true;
+}
+
+bool cli_state_seqnum_persistent(struct cli_state *cli,
+				 uint16_t mid)
+{
+	struct cli_state_seqnum *c;
+


-- 
Samba Shared Repository


More information about the samba-cvs mailing list