s4:libcli: Require signing for SMB encryption

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
index 3a3ecdf20e8d990058ea8ee04388af60afc0e7a8..9540704491ea30a272540692fc0dab4b8273f4d7 100644 (file)
--- a/source4/libcli/smb2/connect.c
+++ b/source4/libcli/smb2/connect.c
@@ -31,6 +31,7 @@
 #include "param/param.h"
 #include "auth/credentials/credentials.h"
 #include "../libcli/smb/smbXcli_base.h"
+#include "smb2_constants.h"
 
 struct smb2_connect_state {
        struct tevent_context *ev;
@@ -76,6 +77,8 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx,
        struct smb2_connect_state *state;
        struct composite_context *creq;
        static const char *default_ports[] = { "445", "139", NULL };
+       enum smb_encryption_setting encryption_state =
+               cli_credentials_get_smb_encryption(credentials);
 
        req = tevent_req_create(mem_ctx, &state,
                                struct smb2_connect_state);
@@ -99,6 +102,10 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx,
                state->ports = default_ports;
        }
 
+       if (encryption_state >= SMB_ENCRYPTION_DESIRED) {
+               state->options.signing = SMB_SIGNING_REQUIRED;
+       }
+
        make_nbt_name_client(&state->calling,
                             cli_credentials_get_workstation(credentials));
 
@@ -116,7 +123,7 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx,
 
                status = smb2_transport_raw_init(state, ev,
                                                 existing_conn,
-                                                options,
+                                                &state->options,
                                                 &state->transport);
                if (tevent_req_nterror(req, status)) {
                        return tevent_req_post(req, ev);