[SCM] Samba Shared Repository - branch master updated
Volker Lendecke
vlendec at samba.org
Fri Sep 11 17:39:02 UTC 2026
The branch, master has been updated
via 235658e3ecc s3:smb2_server: make it possible to sign responses even with encryption
via f6790404d6f libcli/smb: don't reset state->smb2.require_signed_response without NT_STATUS_OK
via 8ae9253241c s4:torture/smb2: There's no need to use smb2cli_session_require_signed_response()
via 5f0a2fec20f s4:libcli/smb2: let smb2_session_setup_spnego_both_ready() call smb2cli_session_check_reauth()
via 4ecb6b83e55 s3:torture: let SMB2-SESSION_REAUTH use smb2cli_session_check_reauth()
via 2df8022bdc8 libcli/smb: add smb2cli_session_check_reauth() helper
from b54246e258d lib:param: Log the right parameter in handle_kdc_supported_enctypes()
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 235658e3ecc1d971e7f963edbeba828748871d1c
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Sep 11 11:21:24 2026 +0200
s3:smb2_server: make it possible to sign responses even with encryption
Final session setup responses should always be signed, even if
they are wrapped with encryption.
This fixed setups where encryption is required and
a session is expired.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15962
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Fri Sep 11 17:38:18 UTC 2026 on atb-devel-224
commit f6790404d6fa04d438b952b6b8f908b6ab4f5d9b
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Sep 11 10:34:40 2026 +0200
libcli/smb: don't reset state->smb2.require_signed_response without NT_STATUS_OK
We no longer use this for reauth tests, so that reset is no longer
needed.
We could remove smb2cli_session_require_signed_response() completely,
but I think it can be useful for other tests in future.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15962
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
commit 8ae9253241c311fa3bbe65a98a8c97d9ec0c649b
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Sep 11 10:22:39 2026 +0200
s4:torture/smb2: There's no need to use smb2cli_session_require_signed_response()
This is now handled by smb2cli_session_check_reauth().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15962
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
commit 5f0a2fec20fa71ccd75bb3d9aaa92cd1233a60db
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Sep 11 10:19:30 2026 +0200
s4:libcli/smb2: let smb2_session_setup_spnego_both_ready() call smb2cli_session_check_reauth()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15962
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
commit 4ecb6b83e55bfb62440c1b309bbaa18fd19bb202
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Sep 11 10:26:49 2026 +0200
s3:torture: let SMB2-SESSION_REAUTH use smb2cli_session_check_reauth()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15962
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
commit 2df8022bdc82e216973d8037e053821fe97c224a
Author: Stefan Metzmacher <metze at samba.org>
Date: Fri Sep 11 10:17:02 2026 +0200
libcli/smb: add smb2cli_session_check_reauth() helper
That checks that the last session setup response of a reauth
is correctly signed by the server.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15962
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
-----------------------------------------------------------------------
Summary of changes:
libcli/smb/smbXcli_base.c | 42 +++++++++++++++++++++++++++++++++---------
libcli/smb/smbXcli_base.h | 2 ++
source3/smbd/smb2_server.c | 33 ++++++++++++++++++++++-----------
source3/torture/test_smb2.c | 7 +++++++
source4/libcli/smb2/session.c | 11 ++++++-----
source4/torture/smb2/session.c | 8 --------
6 files changed, 70 insertions(+), 33 deletions(-)
Changeset truncated at 500 lines:
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index 5d4a91af9a8..e1af9fb56c8 100644
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -4395,15 +4395,6 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
*/
signing_key = NULL;
}
-
- if (!NT_STATUS_IS_OK(status)) {
- /*
- * Only check the signature of the last response
- * of a successful session auth. This matches
- * Windows behaviour for NTLM auth and reauth.
- */
- state->smb2.require_signed_response = false;
- }
}
if (state->smb2.should_sign ||
@@ -7329,6 +7320,39 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
return NT_STATUS_OK;
}
+NTSTATUS smb2cli_session_check_reauth(struct smbXcli_session *session,
+ const struct iovec *recv_iov)
+{
+ struct smbXcli_conn *conn = session->conn;
+ uint32_t hdr_flags;
+ NTSTATUS status;
+
+ if (conn == NULL) {
+ return NT_STATUS_INVALID_PARAMETER_MIX;
+ }
+
+ if (recv_iov[0].iov_len != SMB2_HDR_BODY) {
+ return NT_STATUS_INVALID_PARAMETER_MIX;
+ }
+
+ if (!smb2_signing_key_valid(session->smb2_channel.signing_key)) {
+ return NT_STATUS_INVALID_PARAMETER_MIX;
+ }
+
+ status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
+ recv_iov, 3);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ hdr_flags = IVAL(recv_iov[0].iov_base, SMB2_HDR_FLAGS);
+ if (!(hdr_flags & SMB2_HDR_FLAG_SIGNED)) {
+ return NT_STATUS_INVALID_NETWORK_RESPONSE;
+ }
+
+ return NT_STATUS_OK;
+}
+
NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
{
if (session->smb2->anonymous_signing) {
diff --git a/libcli/smb/smbXcli_base.h b/libcli/smb/smbXcli_base.h
index 27d4fe5b90b..0c626b695e9 100644
--- a/libcli/smb/smbXcli_base.h
+++ b/libcli/smb/smbXcli_base.h
@@ -578,6 +578,8 @@ NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
const DATA_BLOB channel_key,
const struct iovec *recv_iov);
+NTSTATUS smb2cli_session_check_reauth(struct smbXcli_session *session,
+ const struct iovec *recv_iov);
NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session);
uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session);
diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index 5b01cff3516..cf6cbc35d66 100644
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -3769,8 +3769,7 @@ static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
}
if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
- (smb2_signing_key_valid(req->last_sign_key)) &&
- (firsttf->iov_len == 0))
+ smb2_signing_key_valid(req->last_sign_key))
{
int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
@@ -3812,7 +3811,7 @@ static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
return NT_STATUS_NO_MEMORY;
}
- if (req->do_signing && firsttf->iov_len == 0) {
+ if (req->do_signing) {
struct smbXsrv_session *x = req->session;
struct smb2_signing_key *signing_key =
smbd_smb2_signing_key(x, xconn, NULL);
@@ -3858,15 +3857,13 @@ static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
/*
* now check if we need to sign the current response
+ *
+ * This may even happen within a encrypted response, but it's
+ * not the default, as we check req->was_encrypted and then
+ * don't set req->do_signing. But other code can later force
+ * req->do_signing, e.g. the session reauth code.
*/
- if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
- status = smb2_signing_encrypt_pdu(req->first_enc_key,
- firsttf,
- req->out.vector_count - first_idx);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
- } else if (req->do_signing) {
+ if (req->do_signing) {
struct smbXsrv_session *x = req->session;
struct smb2_signing_key *signing_key =
smbd_smb2_signing_key(x, xconn, NULL);
@@ -3878,6 +3875,20 @@ static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
return status;
}
}
+
+ /*
+ * Finally encrypt the whole response, which might be multiple
+ * compound responses at the core SMB2 layer, with the
+ * encryption key of the first response in the compound chain.
+ */
+ if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
+ status = smb2_signing_encrypt_pdu(req->first_enc_key,
+ firsttf,
+ req->out.vector_count - first_idx);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ }
TALLOC_FREE(req->first_enc_key);
if (req->preauth != NULL) {
diff --git a/source3/torture/test_smb2.c b/source3/torture/test_smb2.c
index 29d2b65f2a4..93072bdffd8 100644
--- a/source3/torture/test_smb2.c
+++ b/source3/torture/test_smb2.c
@@ -1947,6 +1947,13 @@ bool run_smb2_session_reauth(int dummy)
return false;
}
+ status = smb2cli_session_check_reauth(cli->smb2.session, recv_iov);
+ if (!NT_STATUS_IS_OK(status)) {
+ printf("smb2cli_session_check_reauth returned %s\n",
+ nt_errstr(status));
+ return false;
+ }
+
status = smb2cli_flush(cli->conn, cli->timeout, cli->smb2.session,
cli->smb2.tcon, fid_persistent, fid_volatile);
if (!NT_STATUS_IS_OK(status)) {
diff --git a/source4/libcli/smb2/session.c b/source4/libcli/smb2/session.c
index 2e9d32a98e5..06d99096c0c 100644
--- a/source4/libcli/smb2/session.c
+++ b/source4/libcli/smb2/session.c
@@ -387,11 +387,6 @@ static void smb2_session_setup_spnego_both_ready(struct tevent_req *req)
return;
}
- if (state->reauth) {
- tevent_req_done(req);
- return;
- }
-
if (cli_credentials_is_anonymous(state->credentials) &&
!state->session->anonymous_session_key)
{
@@ -426,6 +421,12 @@ static void smb2_session_setup_spnego_both_ready(struct tevent_req *req)
return;
}
session->needs_bind = false;
+ } else if (state->reauth) {
+ status = smb2cli_session_check_reauth(session->smbXcli,
+ state->recv_iov);
+ if (tevent_req_nterror(req, status)) {
+ return;
+ }
} else {
status = smb2cli_session_set_session_key(session->smbXcli,
session_key,
diff --git a/source4/torture/smb2/session.c b/source4/torture/smb2/session.c
index 90468f6677d..8d20785c036 100644
--- a/source4/torture/smb2/session.c
+++ b/source4/torture/smb2/session.c
@@ -1213,11 +1213,6 @@ static bool test_session_expire1i(struct torture_context *tctx,
*/
cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED);
- if (!force_encryption) {
- smb2cli_session_require_signed_response(
- tree->session->smbXcli, true);
- }
-
torture_comment(tctx, "%s: reauth => OK\n",
current_timestring(tctx, true));
status = smb2_session_setup_spnego(tree->session,
@@ -1232,9 +1227,6 @@ static bool test_session_expire1i(struct torture_context *tctx,
500 * 1000);
torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
"smb2_session_setup_spnego failed");
-
- smb2cli_session_require_signed_response(
- tree->session->smbXcli, false);
}
ticket_expired = timeval_expired(&endtime);
--
Samba Shared Repository
More information about the samba-cvs
mailing list