s4:libcli: Add smb2_connect_enc_start()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

1 files changed, 38 insertions, 0 deletions

diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c
index 95ff05eac8f..3a3ecdf20e8 100644
--- a/source4/libcli/smb2/connect.c
+++ b/source4/libcli/smb2/connect.c
@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req)
 	tevent_req_set_callback(subreq, smb2_connect_session_done, req);
 }
 
+static void smb2_connect_enc_start(struct tevent_req *req);
 static void smb2_connect_tcon_start(struct tevent_req *req);
 static void smb2_connect_tcon_done(struct tevent_req *subreq);
 
@@ -289,6 +290,43 @@ static void smb2_connect_session_done(struct tevent_req *subreq)
 		return;
 	}
 
+	smb2_connect_enc_start(req);
+}
+
+static void smb2_connect_enc_start(struct tevent_req *req)
+{
+	struct smb2_connect_state *state =
+		tevent_req_data(req,
+				struct smb2_connect_state);
+	enum smb_encryption_setting encryption_state =
+		cli_credentials_get_smb_encryption(state->credentials);
+	NTSTATUS status;
+
+	if (encryption_state < SMB_ENCRYPTION_DESIRED) {
+		smb2_connect_tcon_start(req);
+		return;
+	}
+
+	status = smb2cli_session_encryption_on(state->session->smbXcli);
+	if (!NT_STATUS_IS_OK(status)) {
+		if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
+			if (encryption_state < SMB_ENCRYPTION_REQUIRED) {
+				smb2_connect_tcon_start(req);
+				return;
+			}
+
+			DBG_ERR("Encryption required and server doesn't support "
+				"SMB3 encryption - failing connect\n");
+			tevent_req_nterror(req, status);
+			return;
+		}
+
+		DBG_ERR("Encryption required and setup failed with error %s.\n",
+			nt_errstr(status));
+		tevent_req_nterror(req, NT_STATUS_PROTOCOL_NOT_SUPPORTED);
+		return;
+	}
+
 	smb2_connect_tcon_start(req);
 }