aboutsummaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorSteve French <Yehuda.Sadeh@expand.com>2007-07-09 03:55:14 -0400
committerSteve French <sfrench@us.ibm.com>2007-07-09 03:55:14 -0400
commitb609f06ac4ac77433035366e9aa4dcd7a0f743a0 (patch)
treef4ecd57e0db3c398ffe7cf7eed3214cfff63585b /fs
parent3870253efb65e1960421ca74f5d336218c28fc5b (diff)
[CIFS] Fix packet signatures for NTLMv2 case
Signed-off-by: Yehuda Sadeh Weinraub <Yehuda.Sadeh@expand.com> Signed-off-by: Steve French <sfrench@us.ibm.com>
Diffstat (limited to 'fs')
-rw-r--r--fs/cifs/CHANGES4
-rw-r--r--fs/cifs/TODO6
-rw-r--r--fs/cifs/cifsencrypt.c63
-rw-r--r--fs/cifs/cifsglob.h14
-rw-r--r--fs/cifs/cifsproto.h8
-rw-r--r--fs/cifs/connect.c4
-rw-r--r--fs/cifs/sess.c2
-rw-r--r--fs/cifs/transport.c6
8 files changed, 71 insertions, 36 deletions
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 258130eea9e7..ee276f62bcf4 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,7 @@
1Version 1.50
2------------
3Fix NTLMv2 signing
4
1Version 1.49 5Version 1.49
2------------ 6------------
3IPv6 support. Enable ipv6 addresses to be passed on mount (put the ipv6 7IPv6 support. Enable ipv6 addresses to be passed on mount (put the ipv6
diff --git a/fs/cifs/TODO b/fs/cifs/TODO
index d57dc2917d04..d7bd51575fd6 100644
--- a/fs/cifs/TODO
+++ b/fs/cifs/TODO
@@ -18,9 +18,9 @@ better)
18 18
19d) Kerberos/SPNEGO session setup support - (started) 19d) Kerberos/SPNEGO session setup support - (started)
20 20
21e) More testing of NTLMv2 authentication (mostly implemented - double check 21e) Cleanup now unneeded SessSetup code in
22that NTLMv2 signing works, also need to cleanup now unneeded SessSetup code in 22fs/cifs/connect.c and add back in NTLMSSP code if any servers
23fs/cifs/connect.c) 23need it
24 24
25f) MD5-HMAC signing SMB PDUs when SPNEGO style SessionSetup 25f) MD5-HMAC signing SMB PDUs when SPNEGO style SessionSetup
26used (Kerberos or NTLMSSP). Signing alreadyimplemented for NTLM 26used (Kerberos or NTLMSSP). Signing alreadyimplemented for NTLM
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 8422df81b994..860dc49ba79c 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -41,16 +41,17 @@ extern void SMBencrypt(unsigned char *passwd, unsigned char *c8,
41 unsigned char *p24); 41 unsigned char *p24);
42 42
43static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu, 43static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
44 const char *key, char *signature) 44 const struct mac_key *key, char *signature)
45{ 45{
46 struct MD5Context context; 46 struct MD5Context context;
47 47
48 if ((cifs_pdu == NULL) || (signature == NULL)) 48 if ((cifs_pdu == NULL) || (signature == NULL) || (key == NULL))
49 return -EINVAL; 49 return -EINVAL;
50 50
51 MD5Init(&context); 51 MD5Init(&context);
52 MD5Update(&context, key, CIFS_SESS_KEY_SIZE+16); 52 MD5Update(&context, (char *)&key->data, key->len);
53 MD5Update(&context, cifs_pdu->Protocol, cifs_pdu->smb_buf_length); 53 MD5Update(&context, cifs_pdu->Protocol, cifs_pdu->smb_buf_length);
54
54 MD5Final(signature, &context); 55 MD5Final(signature, &context);
55 return 0; 56 return 0;
56} 57}
@@ -76,7 +77,7 @@ int cifs_sign_smb(struct smb_hdr *cifs_pdu, struct TCP_Server_Info *server,
76 server->sequence_number++; 77 server->sequence_number++;
77 spin_unlock(&GlobalMid_Lock); 78 spin_unlock(&GlobalMid_Lock);
78 79
79 rc = cifs_calculate_signature(cifs_pdu, server->mac_signing_key, 80 rc = cifs_calculate_signature(cifs_pdu, &server->mac_signing_key,
80 smb_signature); 81 smb_signature);
81 if (rc) 82 if (rc)
82 memset(cifs_pdu->Signature.SecuritySignature, 0, 8); 83 memset(cifs_pdu->Signature.SecuritySignature, 0, 8);
@@ -87,16 +88,16 @@ int cifs_sign_smb(struct smb_hdr *cifs_pdu, struct TCP_Server_Info *server,
87} 88}
88 89
89static int cifs_calc_signature2(const struct kvec *iov, int n_vec, 90static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
90 const char *key, char *signature) 91 const struct mac_key *key, char *signature)
91{ 92{
92 struct MD5Context context; 93 struct MD5Context context;
93 int i; 94 int i;
94 95
95 if ((iov == NULL) || (signature == NULL)) 96 if ((iov == NULL) || (signature == NULL) || (key == NULL))
96 return -EINVAL; 97 return -EINVAL;
97 98
98 MD5Init(&context); 99 MD5Init(&context);
99 MD5Update(&context, key, CIFS_SESS_KEY_SIZE+16); 100 MD5Update(&context, (char *)&key->data, key->len);
100 for (i=0;i<n_vec;i++) { 101 for (i=0;i<n_vec;i++) {
101 if (iov[i].iov_base == NULL) { 102 if (iov[i].iov_base == NULL) {
102 cERROR(1 ,("null iovec entry")); 103 cERROR(1 ,("null iovec entry"));
@@ -141,7 +142,7 @@ int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server,
141 server->sequence_number++; 142 server->sequence_number++;
142 spin_unlock(&GlobalMid_Lock); 143 spin_unlock(&GlobalMid_Lock);
143 144
144 rc = cifs_calc_signature2(iov, n_vec, server->mac_signing_key, 145 rc = cifs_calc_signature2(iov, n_vec, &server->mac_signing_key,
145 smb_signature); 146 smb_signature);
146 if (rc) 147 if (rc)
147 memset(cifs_pdu->Signature.SecuritySignature, 0, 8); 148 memset(cifs_pdu->Signature.SecuritySignature, 0, 8);
@@ -151,7 +152,8 @@ int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server,
151 return rc; 152 return rc;
152} 153}
153 154
154int cifs_verify_signature(struct smb_hdr *cifs_pdu, const char *mac_key, 155int cifs_verify_signature(struct smb_hdr *cifs_pdu,
156 const struct mac_key *mac_key,
155 __u32 expected_sequence_number) 157 __u32 expected_sequence_number)
156{ 158{
157 unsigned int rc; 159 unsigned int rc;
@@ -202,15 +204,17 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu, const char *mac_key,
202} 204}
203 205
204/* We fill in key by putting in 40 byte array which was allocated by caller */ 206/* We fill in key by putting in 40 byte array which was allocated by caller */
205int cifs_calculate_mac_key(char * key, const char * rn, const char * password) 207int cifs_calculate_mac_key(struct mac_key *key, const char *rn,
208 const char *password)
206{ 209{
207 char temp_key[16]; 210 char temp_key[16];
208 if ((key == NULL) || (rn == NULL)) 211 if ((key == NULL) || (rn == NULL))
209 return -EINVAL; 212 return -EINVAL;
210 213
211 E_md4hash(password, temp_key); 214 E_md4hash(password, temp_key);
212 mdfour(key,temp_key,16); 215 mdfour(key->data.ntlm, temp_key, 16);
213 memcpy(key+16,rn, CIFS_SESS_KEY_SIZE); 216 memcpy(key->data.ntlm+16, rn, CIFS_SESS_KEY_SIZE);
217 key->len = 40;
214 return 0; 218 return 0;
215} 219}
216 220
@@ -235,35 +239,35 @@ int CalcNTLMv2_partial_mac_key(struct cifsSesInfo * ses,
235 if(ses->domainName == NULL) 239 if(ses->domainName == NULL)
236 return -EINVAL; /* BB should we use CIFS_LINUX_DOM */ 240 return -EINVAL; /* BB should we use CIFS_LINUX_DOM */
237 dom_name_len = strlen(ses->domainName); 241 dom_name_len = strlen(ses->domainName);
238 if(dom_name_len > MAX_USERNAME_SIZE) 242 if (dom_name_len > MAX_USERNAME_SIZE)
239 return -EINVAL; 243 return -EINVAL;
240 244
241 ucase_buf = kmalloc((MAX_USERNAME_SIZE+1), GFP_KERNEL); 245 ucase_buf = kmalloc((MAX_USERNAME_SIZE+1), GFP_KERNEL);
242 if(ucase_buf == NULL) 246 if (ucase_buf == NULL)
243 return -ENOMEM; 247 return -ENOMEM;
244 unicode_buf = kmalloc((MAX_USERNAME_SIZE+1)*4, GFP_KERNEL); 248 unicode_buf = kmalloc((MAX_USERNAME_SIZE+1)*4, GFP_KERNEL);
245 if(unicode_buf == NULL) { 249 if (unicode_buf == NULL) {
246 kfree(ucase_buf); 250 kfree(ucase_buf);
247 return -ENOMEM; 251 return -ENOMEM;
248 } 252 }
249 253
250 for(i=0;i<user_name_len;i++) 254 for (i = 0;i < user_name_len; i++)
251 ucase_buf[i] = nls_info->charset2upper[(int)ses->userName[i]]; 255 ucase_buf[i] = nls_info->charset2upper[(int)ses->userName[i]];
252 ucase_buf[i] = 0; 256 ucase_buf[i] = 0;
253 user_name_len = cifs_strtoUCS(unicode_buf, ucase_buf, MAX_USERNAME_SIZE*2, nls_info); 257 user_name_len = cifs_strtoUCS(unicode_buf, ucase_buf, MAX_USERNAME_SIZE*2, nls_info);
254 unicode_buf[user_name_len] = 0; 258 unicode_buf[user_name_len] = 0;
255 user_name_len++; 259 user_name_len++;
256 260
257 for(i=0;i<dom_name_len;i++) 261 for (i = 0; i < dom_name_len; i++)
258 ucase_buf[i] = nls_info->charset2upper[(int)ses->domainName[i]]; 262 ucase_buf[i] = nls_info->charset2upper[(int)ses->domainName[i]];
259 ucase_buf[i] = 0; 263 ucase_buf[i] = 0;
260 dom_name_len = cifs_strtoUCS(unicode_buf+user_name_len, ucase_buf, MAX_USERNAME_SIZE*2, nls_info); 264 dom_name_len = cifs_strtoUCS(unicode_buf+user_name_len, ucase_buf, MAX_USERNAME_SIZE*2, nls_info);
261 265
262 unicode_buf[user_name_len + dom_name_len] = 0; 266 unicode_buf[user_name_len + dom_name_len] = 0;
263 hmac_md5_update((const unsigned char *) unicode_buf, 267 hmac_md5_update((const unsigned char *) unicode_buf,
264 (user_name_len+dom_name_len)*2,&ctx); 268 (user_name_len+dom_name_len)*2, &ctx);
265 269
266 hmac_md5_final(ses->server->mac_signing_key,&ctx); 270 hmac_md5_final(ses->server->ntlmv2_hash, &ctx);
267 kfree(ucase_buf); 271 kfree(ucase_buf);
268 kfree(unicode_buf); 272 kfree(unicode_buf);
269 return 0; 273 return 0;
@@ -347,7 +351,10 @@ static int calc_ntlmv2_hash(struct cifsSesInfo *ses,
347 if(domain == NULL) 351 if(domain == NULL)
348 goto calc_exit_1; 352 goto calc_exit_1;
349 len = cifs_strtoUCS(domain, ses->domainName, len, nls_cp); 353 len = cifs_strtoUCS(domain, ses->domainName, len, nls_cp);
350 UniStrupr(domain); 354 /* the following line was removed since it didn't work well
355 with lower cased domain name that passed as an option.
356 Maybe converting the domain name earlier makes sense */
357 /* UniStrupr(domain); */
351 358
352 hmac_md5_update((char *)domain, 2*len, pctxt); 359 hmac_md5_update((char *)domain, 2*len, pctxt);
353 360
@@ -358,7 +365,7 @@ calc_exit_1:
358calc_exit_2: 365calc_exit_2:
359 /* BB FIXME what about bytes 24 through 40 of the signing key? 366 /* BB FIXME what about bytes 24 through 40 of the signing key?
360 compare with the NTLM example */ 367 compare with the NTLM example */
361 hmac_md5_final(ses->server->mac_signing_key, pctxt); 368 hmac_md5_final(ses->server->ntlmv2_hash, pctxt);
362 369
363 return rc; 370 return rc;
364} 371}
@@ -368,6 +375,7 @@ void setup_ntlmv2_rsp(struct cifsSesInfo * ses, char * resp_buf,
368{ 375{
369 int rc; 376 int rc;
370 struct ntlmv2_resp * buf = (struct ntlmv2_resp *)resp_buf; 377 struct ntlmv2_resp * buf = (struct ntlmv2_resp *)resp_buf;
378 struct HMACMD5Context context;
371 379
372 buf->blob_signature = cpu_to_le32(0x00000101); 380 buf->blob_signature = cpu_to_le32(0x00000101);
373 buf->reserved = 0; 381 buf->reserved = 0;
@@ -384,6 +392,15 @@ void setup_ntlmv2_rsp(struct cifsSesInfo * ses, char * resp_buf,
384 if(rc) 392 if(rc)
385 cERROR(1,("could not get v2 hash rc %d",rc)); 393 cERROR(1,("could not get v2 hash rc %d",rc));
386 CalcNTLMv2_response(ses, resp_buf); 394 CalcNTLMv2_response(ses, resp_buf);
395
396 /* now calculate the MAC key for NTLMv2 */
397 hmac_md5_init_limK_to_64(ses->server->ntlmv2_hash, 16, &context);
398 hmac_md5_update(resp_buf, 16, &context);
399 hmac_md5_final(ses->server->mac_signing_key.data.ntlmv2.key, &context);
400
401 memcpy(&ses->server->mac_signing_key.data.ntlmv2.resp, resp_buf,
402 sizeof(struct ntlmv2_resp));
403 ses->server->mac_signing_key.len = 16 + sizeof(struct ntlmv2_resp);
387} 404}
388 405
389void CalcNTLMv2_response(const struct cifsSesInfo * ses, char * v2_session_response) 406void CalcNTLMv2_response(const struct cifsSesInfo * ses, char * v2_session_response)
@@ -391,9 +408,9 @@ void CalcNTLMv2_response(const struct cifsSesInfo * ses, char * v2_session_respo
391 struct HMACMD5Context context; 408 struct HMACMD5Context context;
392 /* rest of v2 struct already generated */ 409 /* rest of v2 struct already generated */
393 memcpy(v2_session_response + 8, ses->server->cryptKey,8); 410 memcpy(v2_session_response + 8, ses->server->cryptKey,8);
394 hmac_md5_init_limK_to_64(ses->server->mac_signing_key, 16, &context); 411 hmac_md5_init_limK_to_64(ses->server->ntlmv2_hash, 16, &context);
395 412
396 hmac_md5_update(v2_session_response+8, 413 hmac_md5_update(v2_session_response+8,
397 sizeof(struct ntlmv2_resp) - 8, &context); 414 sizeof(struct ntlmv2_resp) - 8, &context);
398 415
399 hmac_md5_final(v2_session_response,&context); 416 hmac_md5_final(v2_session_response,&context);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index e16a2c473003..0a7813175a27 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -104,6 +104,17 @@ enum protocolEnum {
104 /* Netbios frames protocol not supported at this time */ 104 /* Netbios frames protocol not supported at this time */
105}; 105};
106 106
107struct mac_key {
108 unsigned int len;
109 union {
110 char ntlm[CIFS_SESS_KEY_SIZE + 16];
111 struct {
112 char key[16];
113 struct ntlmv2_resp resp;
114 } ntlmv2;
115 } data;
116};
117
107/* 118/*
108 ***************************************************************** 119 *****************************************************************
109 * Except the CIFS PDUs themselves all the 120 * Except the CIFS PDUs themselves all the
@@ -159,7 +170,8 @@ struct TCP_Server_Info {
159 /* 16th byte of RFC1001 workstation name is always null */ 170 /* 16th byte of RFC1001 workstation name is always null */
160 char workstation_RFC1001_name[SERVER_NAME_LEN_WITH_NULL]; 171 char workstation_RFC1001_name[SERVER_NAME_LEN_WITH_NULL];
161 __u32 sequence_number; /* needed for CIFS PDU signature */ 172 __u32 sequence_number; /* needed for CIFS PDU signature */
162 char mac_signing_key[CIFS_SESS_KEY_SIZE + 16]; 173 struct mac_key mac_signing_key;
174 char ntlmv2_hash[16];
163 unsigned long lstrp; /* when we got last response from this server */ 175 unsigned long lstrp; /* when we got last response from this server */
164}; 176};
165 177
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 4a89f038af28..6a6e3f9f3f8b 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -294,9 +294,11 @@ extern void tconInfoFree(struct cifsTconInfo *);
294extern int cifs_sign_smb(struct smb_hdr *, struct TCP_Server_Info *, __u32 *); 294extern int cifs_sign_smb(struct smb_hdr *, struct TCP_Server_Info *, __u32 *);
295extern int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *, 295extern int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *,
296 __u32 *); 296 __u32 *);
297extern int cifs_verify_signature(struct smb_hdr *, const char *mac_key, 297extern int cifs_verify_signature(struct smb_hdr *,
298 __u32 expected_sequence_number); 298 const struct mac_key *mac_key,
299extern int cifs_calculate_mac_key(char *key, const char *rn, const char *pass); 299 __u32 expected_sequence_number);
300extern int cifs_calculate_mac_key(struct mac_key *key, const char *rn,
301 const char *pass);
300extern int CalcNTLMv2_partial_mac_key(struct cifsSesInfo *, 302extern int CalcNTLMv2_partial_mac_key(struct cifsSesInfo *,
301 const struct nls_table *); 303 const struct nls_table *);
302extern void CalcNTLMv2_response(const struct cifsSesInfo *, char * ); 304extern void CalcNTLMv2_response(const struct cifsSesInfo *, char * );
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 8f436ef24368..9b95d4637fcc 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3475,7 +3475,7 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3475 3475
3476 if(first_time) 3476 if(first_time)
3477 cifs_calculate_mac_key( 3477 cifs_calculate_mac_key(
3478 pSesInfo->server->mac_signing_key, 3478 &pSesInfo->server->mac_signing_key,
3479 ntlm_session_key, 3479 ntlm_session_key,
3480 pSesInfo->password); 3480 pSesInfo->password);
3481 } 3481 }
@@ -3495,7 +3495,7 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
3495 3495
3496 if(first_time) 3496 if(first_time)
3497 cifs_calculate_mac_key( 3497 cifs_calculate_mac_key(
3498 pSesInfo->server->mac_signing_key, 3498 &pSesInfo->server->mac_signing_key,
3499 ntlm_session_key, pSesInfo->password); 3499 ntlm_session_key, pSesInfo->password);
3500 3500
3501 rc = CIFSSessSetup(xid, pSesInfo, 3501 rc = CIFSSessSetup(xid, pSesInfo,
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index b3f9d40d06db..f45c4730e92e 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -419,7 +419,7 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
419 419
420 if (first_time) /* should this be moved into common code 420 if (first_time) /* should this be moved into common code
421 with similar ntlmv2 path? */ 421 with similar ntlmv2 path? */
422 cifs_calculate_mac_key(ses->server->mac_signing_key, 422 cifs_calculate_mac_key(&ses->server->mac_signing_key,
423 ntlm_session_key, ses->password); 423 ntlm_session_key, ses->password);
424 /* copy session key */ 424 /* copy session key */
425 425
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 01b589163bd8..f9ebe70ecc4d 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -559,7 +559,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
559 (ses->server->secMode & (SECMODE_SIGN_REQUIRED | 559 (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
560 SECMODE_SIGN_ENABLED))) { 560 SECMODE_SIGN_ENABLED))) {
561 rc = cifs_verify_signature(midQ->resp_buf, 561 rc = cifs_verify_signature(midQ->resp_buf,
562 ses->server->mac_signing_key, 562 &ses->server->mac_signing_key,
563 midQ->sequence_number+1); 563 midQ->sequence_number+1);
564 if (rc) { 564 if (rc) {
565 cERROR(1, ("Unexpected SMB signature")); 565 cERROR(1, ("Unexpected SMB signature"));
@@ -738,7 +738,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
738 (ses->server->secMode & (SECMODE_SIGN_REQUIRED | 738 (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
739 SECMODE_SIGN_ENABLED))) { 739 SECMODE_SIGN_ENABLED))) {
740 rc = cifs_verify_signature(out_buf, 740 rc = cifs_verify_signature(out_buf,
741 ses->server->mac_signing_key, 741 &ses->server->mac_signing_key,
742 midQ->sequence_number+1); 742 midQ->sequence_number+1);
743 if (rc) { 743 if (rc) {
744 cERROR(1, ("Unexpected SMB signature")); 744 cERROR(1, ("Unexpected SMB signature"));
@@ -982,7 +982,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
982 (ses->server->secMode & (SECMODE_SIGN_REQUIRED | 982 (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
983 SECMODE_SIGN_ENABLED))) { 983 SECMODE_SIGN_ENABLED))) {
984 rc = cifs_verify_signature(out_buf, 984 rc = cifs_verify_signature(out_buf,
985 ses->server->mac_signing_key, 985 &ses->server->mac_signing_key,
986 midQ->sequence_number+1); 986 midQ->sequence_number+1);
987 if (rc) { 987 if (rc) {
988 cERROR(1, ("Unexpected SMB signature")); 988 cERROR(1, ("Unexpected SMB signature"));