samba - Apr 2024 - Bad SMB2 (sign_algo_id=1) signature for message

01.03.2024 16:03, Michael Tokarev via samba:
> Hi!
> 
> I'm seeing quite some messages in log.smbd like this:
> 
> [2024/03/01 15:59:00.612141,? 0, pid=1778617]
libcli/smb/smb2_signing.c:639(smb2_signing_check_pdu)
>  ? Bad SMB2 (sign_algo_id=1) signature for message
> [2024/03/01 15:59:00.612146,? 0, pid=1778616]
lib/util/util.c:578(dump_data)
>  ? [0000] 7E 8D E3 FE A9 44 E8 E3?? A6 76 22 6A B2 A4 27 CF?? ~....D..
.v"j..'.
> [2024/03/01 15:59:00.612166,? 0, pid=1778617]
lib/util/util.c:578(dump_data)
>  ? [0000] 2D 99 5B 40 BA B0 66 BA?? 12 18 38 1D B0 98 DA F4?? -.[@..f.
..8.....
> [2024/03/01 15:59:00.612194,? 0, pid=1778616]
lib/util/util.c:578(dump_data)
>  ? [0000] C7 20 D2 A3 8F 8E 5B A4?? 88 A2 46 A1 C6 FA 86 3F?? . ....[.
..F....?
> [2024/03/01 15:59:00.612204,? 0, pid=1778617]
lib/util/util.c:578(dump_data)
>  ? [0000] 1A 87 8B ED C2 24 9E 4A?? BD 15 15 F2 B0 DD 24 D8?? .....$.J
......$.
> [2024/03/01 15:59:00.612268,? 0, pid=1778616]
libcli/smb/smb2_signing.c:639(smb2_signing_check_pdu)
>  ? Bad SMB2 (sign_algo_id=1) signature for message
> [2024/03/01 15:59:00.612270,? 0, pid=1778617]
libcli/smb/smb2_signing.c:639(smb2_signing_check_pdu)
>  ? Bad SMB2 (sign_algo_id=1) signature for message
Any guess for all this?

Seeing *massive* amount of these messages in logs.

Thanks,

/mjt

> [2024/03/01 15:59:00.612141,  0, pid=1778617]
libcli/smb/smb2_signing.c:639(smb2_signing_check_pdu)
>    Bad SMB2 (sign_algo_id=1) signature for message
Hello Michael,

what is the linux distro and samba version in your env, thank you :)

It looks like a client-side tool could see similar output, from my env:
$ rpcclient -U 'nobody%nobody' -c 'netshareenumall' 127.0.0.1
Bad SMB2 (sign_algo_id=2) signature for message
[0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
[0000] 3B F0 CD 43 12 2D 1F D2   47 30 64 EE 8C 45 29 D2   ;..C.-.. G0d..E).
Cannot connect to server.  Error was NT_STATUS_ACCESS_DENIED
$ rpcclient --version
Version 4.15.13-Ubuntu

My environment is:
Ubuntu 22.04.4 LTS
Samba 4.15.13

--

Regards,
Jones Syue | ???
QNAP Systems, Inc.