samba.git/libcli/smb/smbXcli_base.c, branch talloc-2.4.4

libsmb: Avoid smb-level encryption if quic is trusted

2025-08-22T14:55:46+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Ralph Boehme 

Autobuild-User(master): Ralph Böhme 
Autobuild-Date(master): Fri Aug 22 14:55:47 UTC 2025 on atb-devel-224

libsmb: Negotiate SMB2_ACCEPT_TRANSPORT_LEVEL_SECURITY over quic

2025-08-22T13:55:34+00:00

If we trust quic, indicate to the server that we do so.

Signed-off-by: Volker Lendecke 
Reviewed-by: Ralph Boehme

libcli: Add tls_verify_peer_state to smbXcli_transport

2025-08-22T13:55:33+00:00

We have to carry a copy over from the tstream_tls_params used to
connect, we can't get this information out once the tls-protected
tstream is established

Signed-off-by: Volker Lendecke 
Reviewed-by: Ralph Boehme

libcli: Introduce helper var in smbXcli_negprot_smb2_subreq()

2025-08-22T13:55:33+00:00

Saves a few bytes of code

Signed-off-by: Volker Lendecke 
Reviewed-by: Ralph Boehme

libcli/smb: use talloc_asprintf_addbuf() in smbXcli_session_dump_keys()

2025-07-22T15:09:11+00:00

Avoids DEBUGADD() which can lead to intersected output in the logfile.

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke 

Autobuild-User(master): Volker Lendecke 
Autobuild-Date(master): Tue Jul 22 15:09:11 UTC 2025 on atb-devel-224

libcli/smb2: dump encryption key in format for Wireshark ~/.wireshark/smb2_seskey_list

2025-07-22T14:08:36+00:00

This allows dumping the keys and quickly feeding them into Wireshark by adding
them to ~/.wireshark/smb2_seskey_list.

Example:

  debug encryption: dumping generated session keys
  Session Id    [0000] 7D 00 00 E8 57 E0 31 01                             }...W.1.
  Session Key   [0000] 71 54 77 50 C1 DD 66 68   A8 51 D8 DE 23 F4 91 01   qTwP..fh .Q..#...
  Signing Key   [0000] B1 29 AC EF 41 30 AE D2   43 00 1F 67 87 29 BF DB   .)..A0.. C..g.)..
  App Key       [0000] 6A 88 5C 51 51 22 FF 5C   25 95 A2 5C E2 2C FC 5D   j.\QQ".\ %..\.,.]
  ServerIn Key  [0000] 20 08 EB A2 14 99 17 03   9C A5 9A BB B8 48 88 3C    ....... .....H.<
  ServerOut Key [0000] 15 AA C2 0D 19 AB 4C 26   64 E8 FC 94 B1 FE 27 5A   ......L& d.....'Z
  Wireshark configuration line
  7d0000e857e03101,71547750c1dd6668a851d8de23f49101,15aac20d19ab4c2664e8fc94b1fe275a,2008eba2149917039ca59abbb848883c

When setting

    debug encryption = yes
    debug encryption:wireshark keyfile = /home/slow/.wireshark/smb2_seskey_list

the keys are appended directly to Wireshark's keyfile. Wireshark has to be
restarted to pick them up.

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke

libcli/smb: also dump signing_algo in smbXcli_session_dump_keys()

2025-07-22T14:08:36+00:00

The server side already does that and I'm aiming for consolidating server and
client code for dumping the keys.

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke

libcli/smb: make smbXcli_session_dump_keys() usable for the server side

2025-07-22T14:08:36+00:00

By passing the individual keys directly instead of passing the wrapping state
objects, smbXcli_session_dump_keys() can later also be used by the server code.

No change in behaviour.

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke

libcli/smb: move cli_session_dump_keys() to libsmb

2025-07-22T14:08:36+00:00

More callers to come...

Signed-off-by: Ralph Boehme 
Reviewed-by: Volker Lendecke

libcli/smb: add smbXcli_transport_bsd_tstream()

2025-06-18T17:52:37+00:00

This can be used to force the usage of the tstream code path even
for bsd sockets.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Volker Lendecke