|
 |
b6b438 |
From 5076ca90caf92b56a5708cf185835e74ddfe3cfb Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Thu, 14 Mar 2019 09:34:23 +0100
|
|
|
b6b438 |
Subject: [PATCH 113/187] libcli:smb: Use a smb2_signing_key for storing the
|
|
|
b6b438 |
encryption key
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
b6b438 |
(cherry picked from commit 48116a30d51d9bac6201a8b94262aa78b451ad63)
|
|
|
b6b438 |
---
|
|
|
b6b438 |
libcli/smb/smbXcli_base.c | 29 +++++++++++++++++++----------
|
|
|
b6b438 |
1 file changed, 19 insertions(+), 10 deletions(-)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
|
|
|
b6b438 |
index bfc85ecc225..52bc438c389 100644
|
|
|
b6b438 |
--- a/libcli/smb/smbXcli_base.c
|
|
|
b6b438 |
+++ b/libcli/smb/smbXcli_base.c
|
|
|
b6b438 |
@@ -154,7 +154,7 @@ struct smb2cli_session {
|
|
|
b6b438 |
struct smb2_signing_key *signing_key;
|
|
|
b6b438 |
bool should_sign;
|
|
|
b6b438 |
bool should_encrypt;
|
|
|
b6b438 |
- DATA_BLOB encryption_key;
|
|
|
b6b438 |
+ struct smb2_signing_key *encryption_key;
|
|
|
b6b438 |
DATA_BLOB decryption_key;
|
|
|
b6b438 |
uint64_t nonce_high_random;
|
|
|
b6b438 |
uint64_t nonce_high_max;
|
|
|
b6b438 |
@@ -3090,7 +3090,7 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
|
|
|
b6b438 |
struct iovec *iov;
|
|
|
b6b438 |
int i, num_iov, nbt_len;
|
|
|
b6b438 |
int tf_iov = -1;
|
|
|
b6b438 |
- const DATA_BLOB *encryption_key = NULL;
|
|
|
b6b438 |
+ const struct smb2_signing_key *encryption_key = NULL;
|
|
|
b6b438 |
uint64_t encryption_session_id = 0;
|
|
|
b6b438 |
uint64_t nonce_high = UINT64_MAX;
|
|
|
b6b438 |
uint64_t nonce_low = UINT64_MAX;
|
|
|
b6b438 |
@@ -3137,8 +3137,8 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
|
|
|
b6b438 |
continue;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- encryption_key = &state->session->smb2->encryption_key;
|
|
|
b6b438 |
- if (encryption_key->length == 0) {
|
|
|
b6b438 |
+ encryption_key = state->session->smb2->encryption_key;
|
|
|
b6b438 |
+ if (!smb2_signing_key_valid(encryption_key)) {
|
|
|
b6b438 |
return NT_STATUS_INVALID_PARAMETER_MIX;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
@@ -3379,7 +3379,7 @@ skip_credits:
|
|
|
b6b438 |
buf += v->iov_len;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- status = smb2_signing_encrypt_pdu(*encryption_key,
|
|
|
b6b438 |
+ status = smb2_signing_encrypt_pdu(encryption_key->blob,
|
|
|
b6b438 |
state->conn->smb2.server.cipher,
|
|
|
b6b438 |
&iov[tf_iov], num_iov - tf_iov);
|
|
|
b6b438 |
if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
@@ -5723,11 +5723,11 @@ NTSTATUS smb2cli_session_encryption_key(struct smbXcli_session *session,
|
|
|
b6b438 |
return NT_STATUS_NO_USER_SESSION_KEY;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- if (session->smb2->encryption_key.length == 0) {
|
|
|
b6b438 |
+ if (!smb2_signing_key_valid(session->smb2->encryption_key)) {
|
|
|
b6b438 |
return NT_STATUS_NO_USER_SESSION_KEY;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- *key = data_blob_dup_talloc(mem_ctx, session->smb2->encryption_key);
|
|
|
b6b438 |
+ *key = data_blob_dup_talloc(mem_ctx, session->smb2->encryption_key->blob);
|
|
|
b6b438 |
if (key->data == NULL) {
|
|
|
b6b438 |
return NT_STATUS_NO_MEMORY;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
@@ -6121,9 +6121,18 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
session->smb2->encryption_key =
|
|
|
b6b438 |
- data_blob_dup_talloc(session,
|
|
|
b6b438 |
+ talloc_zero(session, struct smb2_signing_key);
|
|
|
b6b438 |
+ if (session->smb2->encryption_key == NULL) {
|
|
|
b6b438 |
+ ZERO_STRUCT(session_key);
|
|
|
b6b438 |
+ return NT_STATUS_NO_MEMORY;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
+ talloc_set_destructor(session->smb2->encryption_key,
|
|
|
b6b438 |
+ smb2_signing_key_destructor);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ session->smb2->encryption_key->blob =
|
|
|
b6b438 |
+ data_blob_dup_talloc(session->smb2->encryption_key,
|
|
|
b6b438 |
session->smb2->signing_key->blob);
|
|
|
b6b438 |
- if (session->smb2->encryption_key.data == NULL) {
|
|
|
b6b438 |
+ if (!smb2_signing_key_valid(session->smb2->encryption_key)) {
|
|
|
b6b438 |
ZERO_STRUCT(session_key);
|
|
|
b6b438 |
return NT_STATUS_NO_MEMORY;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
@@ -6134,7 +6143,7 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
|
|
|
b6b438 |
status = smb2_key_derivation(session_key, sizeof(session_key),
|
|
|
b6b438 |
d->label.data, d->label.length,
|
|
|
b6b438 |
d->context.data, d->context.length,
|
|
|
b6b438 |
- session->smb2->encryption_key.data);
|
|
|
b6b438 |
+ session->smb2->encryption_key->blob.data);
|
|
|
b6b438 |
if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
return status;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|