-
Notifications
You must be signed in to change notification settings - Fork 3.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix SMB2 compoud response signing #1834
Conversation
c954e79
to
31806c1
Compare
Hey @jborean93, thanks for all these PRs! Reading the code changes for this one, seems aligned now with the documentation. Will do some tests on this branch before moving forward! Update: Documentation answered my question... it's advised but not mandatory (3.3.4.1.3 Sending Compounded Responses)
|
That's a good point, I'll update the code to always pad each compound message including the last one to align with the SHOULD in the docs. |
Fix the signing the logic when responding with an SMB2 compount response. The signature will include the padding of each compound element and include the next offset value before signing the data.
31806c1
to
ec41881
Compare
ec41881
to
1c5a202
Compare
Awesome! |
Thanks for the reviews on the various PRs. |
* Fix SMB2 compoud response signing Fix the signing the logic when responding with an SMB2 compount response. The signature will include the padding of each compound element and include the next offset value before signing the data. * Pad all SMB2 packets, even the last in a compound response
* Fix SMB2 compoud response signing Fix the signing the logic when responding with an SMB2 compount response. The signature will include the padding of each compound element and include the next offset value before signing the data. * Pad all SMB2 packets, even the last in a compound response
Fix the signing the logic when responding with an SMB2 compount response. The signature will include the padding of each compound element and include the next offset value before signing the data.
The current logic was adding the signature but before it set the
NextCommand
entry and it did not include any of the padding added between each compound entry. By delaying the signing until after the compound entries are build we can ensure that the signatures are generated correctly so the client can verify them.The padding data must be included in the signature as per MS-SMB2 https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/a3e9ea1e-53c8-4cff-94bd-d98fb20417c0