Share via

3.1.5.1 Receiving Any Message

  • Article

If a message is received and IsSigningActive is TRUE, unless otherwise specified, the signature of the message MUST be verified by the client or the server receiving the message. See section 3.2.5.1 and 3.3.5.2, respectively.

This logic MUST be applied for any messages received, as defined in the message sequencing rules:

  • The client or server that receives the message MUST save a temporary copy of the SMB_Header.SecuritySignature field of the received message.

  • To test the signature, the expected 32-bit sequence number for the received message is copied into the least significant 32 bits of the SecuritySignature field, and the remaining 4 bytes of the SecuritySignature field are set to 0x00.

  • The MD5 algorithm, as specified in [RFC1321], MUST be used to generate a hash of the SMB message (from the start of the SMB header), which is defined as follows.

     CALL MD5Init( md5context )
 CALL MD5Update( md5context, Connection.SigningSessionKey )
 CALL MD5Update( md5context, Connection.SigningChallengeResponse )
 CALL MD5Update( md5context, SMB message )
 CALL MD5Final( digest, md5context )
 SET signature TO first 8 bytes of digest
 

The resulting 8-byte signature is compared with the original value of the SecuritySignature field from the SMB Header (section 2.2.3.1). If the signature received with the message does not match the signature calculated, the message MUST be discarded, and no further processing is done on it. The receiver MAY also terminate the connection by disconnecting the underlying transport connection and cleaning up any state associated with the connection.