diff options
| author | Stefan Metzmacher <metze@samba.org> | 2019-06-11 17:44:04 +0200 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2019-06-12 13:56:19 +0000 |
| commit | b336d09b7b18370098ee73e63cf794a161e1ecb3 (patch) | |
| tree | 24f66a06236546df24b609a27e23e37596e89ebd /libcli | |
| parent | 317054f6eb7c485d8a5476df6df7dbc05a51c4a4 (diff) | |
| download | samba-b336d09b7b18370098ee73e63cf794a161e1ecb3.tar.gz | |
libcli/smb: harden smbXcli_session_shallow_copy against nonce reusage
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jun 12 13:56:19 UTC 2019 on sn-devel-184
Diffstat (limited to 'libcli')
| -rw-r--r-- | libcli/smb/smbXcli_base.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c index 3d7a0625ccc..1af550d9cdd 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c @@ -5562,6 +5562,8 @@ struct smbXcli_session *smbXcli_session_shallow_copy(TALLOC_CTX *mem_ctx, struct smbXcli_session *src) { struct smbXcli_session *session; + struct timespec ts; + NTTIME nt; session = talloc_zero(mem_ctx, struct smbXcli_session); if (session == NULL) { @@ -5583,6 +5585,23 @@ struct smbXcli_session *smbXcli_session_shallow_copy(TALLOC_CTX *mem_ctx, session->smb2_channel = src->smb2_channel; session->disconnect_expired = src->disconnect_expired; + /* + * This is only supposed to be called in test code + * but we should not reuse nonces! + * + * Add the current timestamp as NTTIME to nonce_high + * and set nonce_low to a value we can recognize in captures. + */ + clock_gettime_mono(&ts); + nt = unix_timespec_to_nt_time(ts); + nt &= session->smb2->nonce_high_max; + if (nt == session->smb2->nonce_high_max || nt < UINT8_MAX) { + talloc_free(session); + return NULL; + } + session->smb2->nonce_high += nt; + session->smb2->nonce_low = UINT32_MAX; + DLIST_ADD_END(src->conn->sessions, session); talloc_set_destructor(session, smbXcli_session_destructor); |