From: Michael Adam <obnox@samba.org>
Date: Wed, 1 Jul 2015 16:07:52 +0000 (+0200)
Subject: smbd:smb2: only enable encryption in tcon if desired
X-Git-Tag: samba-4.1.20~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=57c879aa568f3c5f81e5ebd167cebdefe0f55af3;p=thirdparty%2Fsamba.git

smbd:smb2: only enable encryption in tcon if desired

Don't enforce it but only announce DATA_ENCRYPT,
making use of encryption_desired in tcon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 41cb881e775ea7eb0c59d9e0cafb6ab5531918d9)
---

diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c
index bde05b5f360..014264d9abd 100644
--- a/source3/smbd/smb2_tcon.c
+++ b/source3/smbd/smb2_tcon.c
@@ -185,6 +185,7 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
 	connection_struct *compat_conn = NULL;
 	struct user_struct *compat_vuser = req->session->compat;
 	NTSTATUS status;
+	bool encryption_desired = req->session->encryption_desired;
 	bool encryption_required = req->session->global->encryption_required;
 	bool guest_session = false;
 
@@ -236,12 +237,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
 		return NT_STATUS_BAD_NETWORK_NAME;
 	}
 
-	if ((lp_smb_encrypt(snum) > SMB_SIGNING_OFF) &&
+	if ((lp_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) &&
 	    (conn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) {
-		encryption_required = true;
+		encryption_desired = true;
 	}
 
 	if (lp_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) {
+		encryption_desired = true;
 		encryption_required = true;
 	}
 
@@ -270,6 +272,7 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
 		return status;
 	}
 
+	tcon->encryption_desired = encryption_desired;
 	tcon->global->encryption_required = encryption_required;
 
 	compat_conn = make_connection_smb2(req->sconn,
@@ -340,7 +343,7 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
 		*out_share_flags |= SMB2_SHAREFLAG_ACCESS_BASED_DIRECTORY_ENUM;
 	}
 
-	if (encryption_required) {
+	if (encryption_desired) {
 		*out_share_flags |= SMB2_SHAREFLAG_ENCRYPT_DATA;
 	}