NTLM auth and sign - Define crypto hash functions and create and send keys needed for key exchange

Mark dependency on crypto modules in Kconfig.

Defining per structures sdesc and cifs_secmech which are used to store
crypto hash functions and contexts.  They are stored per smb connection
and used for all auth mechs to genereate hash values and signatures.

Allocate crypto hashing functions, security descriptiors, and respective
contexts when a smb/tcp connection is established.
Release them when a tcp/smb connection is taken down.

md5 and hmac-md5 are two crypto hashing functions that are used
throught the life of an smb/tcp connection by various functions that
calcualte signagure and ntlmv2 hash, HMAC etc.

structure ntlmssp_auth is defined as per smb connection.

ntlmssp_auth holds ciphertext which is genereated by rc4/arc4 encryption of
secondary key, a nonce using ntlmv2 session key and sent in the session key
field of the type 3 message sent by the client during ntlmssp
negotiation/exchange

A key is exchanged with the server if client indicates so in flags in
type 1 messsage and server agrees in flag in type 2 message of ntlmssp
negotiation.  If both client and agree, a key sent by client in
type 3 message of ntlmssp negotiation in the session key field.
The key is a ciphertext generated off of secondary key, a nonce, using
ntlmv2 hash via rc4/arc4.

Signing works for ntlmssp in this patch. The sequence number within
the server structure needs to be zero until session is established
i.e. till type 3 packet of ntlmssp exchange of a to be very first
smb session on that smb connection is sent.

Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

1 files changed, 13 insertions, 3 deletions

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index dd9a4ae1d21d..04239a7ff320 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1563,6 +1563,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server)
         server->tcpStatus = CifsExiting;
         spin_unlock(&GlobalMid_Lock);
 
+        cifs_crypto_shash_release(server);
         cifs_fscache_release_client_cookie(server);
 
         kfree(server->session_key.response);
@@ -1621,10 +1622,16 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                 goto out_err;
         }
 
+        rc = cifs_crypto_shash_allocate(tcp_ses);
+        if (rc) {
+                cERROR(1, "could not setup hash structures rc %d", rc);
+                goto out_err;
+        }
+
         tcp_ses->hostname = extract_hostname(volume_info->UNC);
         if (IS_ERR(tcp_ses->hostname)) {
                 rc = PTR_ERR(tcp_ses->hostname);
-                goto out_err;
+                goto out_err2;
         }
 
         tcp_ses->noblocksnd = volume_info->noblocksnd;
@@ -1668,7 +1675,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
         }
         if (rc < 0) {
                 cERROR(1, "Error connecting to socket. Aborting operation");
-                goto out_err;
+                goto out_err2;
         }
 
         /*
@@ -1682,7 +1689,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                 rc = PTR_ERR(tcp_ses->tsk);
                 cERROR(1, "error %d create cifsd thread", rc);
                 module_put(THIS_MODULE);
-                goto out_err;
+                goto out_err2;
         }
 
         /* thread spawned, put it on the list */
@@ -1694,6 +1701,9 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
 
         return tcp_ses;
 
+out_err2:
+        cifs_crypto_shash_release(tcp_ses);
+
 out_err:
         if (tcp_ses) {
                 if (!IS_ERR(tcp_ses->hostname))