From: Andreas Schneider <asn@samba.org>
Date: Thu, 28 May 2020 14:10:52 +0000 (+0200)
Subject: auth:creds: Add cli_credentials_(get|set)_smb_encryption()
X-Git-Tag: talloc-2.3.2~800
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=836c5e01e653549b8aada13b9ef8c44d79c3411a;p=thirdparty%2Fsamba.git

auth:creds: Add cli_credentials_(get|set)_smb_encryption()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---

diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index dc5d51f1424..9168b92d3ec 100644
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -51,6 +51,7 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
 	 * the same value here.
 	 */
 	cred->ipc_signing_state = SMB_SIGNING_REQUIRED;
+	cred->encryption_state = SMB_ENCRYPTION_DEFAULT;
 
 	return cred;
 }
@@ -942,6 +943,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
 		cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx);
 		cred->ipc_signing_state_obtained = CRED_SMB_CONF;
 	}
+
+	if (cred->encryption_state_obtained <= CRED_SMB_CONF) {
+		/* Will be set to default for invalid smb.conf values */
+		cred->encryption_state = lpcfg_client_smb_encrypt(lp_ctx);
+		cred->encryption_state_obtained = CRED_SMB_CONF;
+	}
 }
 
 /**
@@ -1401,6 +1408,44 @@ cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds)
 	return creds->ipc_signing_state;
 }
 
+/**
+ * @brief Set the SMB encryption state to request for a SMB connection.
+ *
+ * @param[in]  creds  The credentials structure to update.
+ *
+ * @param[in]  encryption_state  The encryption state to set.
+ *
+ * @param obtained  This way the described encryption state was specified.
+ *
+ * @return true if we could set the encryption state, false otherwise.
+ */
+_PUBLIC_ bool cli_credentials_set_smb_encryption(struct cli_credentials *creds,
+						 enum smb_encryption_setting encryption_state,
+						 enum credentials_obtained obtained)
+{
+	if (obtained >= creds->encryption_state_obtained) {
+		creds->encryption_state_obtained = obtained;
+		creds->encryption_state = encryption_state;
+		return true;
+	}
+
+	return false;
+}
+
+/**
+ * @brief Obtain the SMB encryption state from a credentials structure.
+ *
+ * @param[in]  creds  The credential structure to obtain the SMB encryption state
+ *                    from.
+ *
+ * @return The SMB singing state.
+ */
+_PUBLIC_ enum smb_encryption_setting
+cli_credentials_get_smb_encryption(struct cli_credentials *creds)
+{
+	return creds->encryption_state;
+}
+
 /**
  * Encrypt a data blob using the session key and the negotiated encryption
  * algorithm
diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
index 2333b991526..1a3e611fee8 100644
--- a/auth/credentials/credentials.h
+++ b/auth/credentials/credentials.h
@@ -39,6 +39,7 @@ struct smb_krb5_context;
 struct keytab_container;
 struct db_context;
 enum smb_signing_setting;
+enum smb_encryption_setting;
 
 /* In order of priority */
 enum credentials_obtained { 
@@ -303,6 +304,12 @@ bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred,
 enum smb_signing_setting
 cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred);
 
+bool cli_credentials_set_smb_encryption(struct cli_credentials *cred,
+					enum smb_encryption_setting encryption_state,
+					enum credentials_obtained obtained);
+enum smb_encryption_setting
+cli_credentials_get_smb_encryption(struct cli_credentials *cred);
+
 /**
  * Return attached NETLOGON credentials 
  */
diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h
index 54e8271471f..3b86b742448 100644
--- a/auth/credentials/credentials_internal.h
+++ b/auth/credentials/credentials_internal.h
@@ -39,6 +39,7 @@ struct cli_credentials {
 	enum credentials_obtained server_gss_creds_obtained;
 	enum credentials_obtained signing_state_obtained;
 	enum credentials_obtained ipc_signing_state_obtained;
+	enum credentials_obtained encryption_state_obtained;
 
 	/* Threshold values (essentially a MAX() over a number of the
 	 * above) for the ccache and GSS credentials, to ensure we
@@ -124,6 +125,8 @@ struct cli_credentials {
 	enum smb_signing_setting signing_state;
 
 	enum smb_signing_setting ipc_signing_state;
+
+	enum smb_encryption_setting encryption_state;
 };
 
 #endif /* __CREDENTIALS_INTERNAL_H__ */