From patchwork Wed Aug 27 00:02:22 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Namjae Jeon X-Patchwork-Id: 4784751 Return-Path: X-Original-To: patchwork-cifs-client@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 46E27C0338 for ; Wed, 27 Aug 2014 00:02:29 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 6C85A201FE for ; Wed, 27 Aug 2014 00:02:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E17BD201F7 for ; Wed, 27 Aug 2014 00:02:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756207AbaH0AC0 (ORCPT ); Tue, 26 Aug 2014 20:02:26 -0400 Received: from mailout1.samsung.com ([203.254.224.24]:25631 "EHLO mailout1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755907AbaH0ACZ (ORCPT ); Tue, 26 Aug 2014 20:02:25 -0400 Received: from epcpsbgr1.samsung.com (u141.gpu120.samsung.co.kr [203.254.230.141]) by mailout1.samsung.com (Oracle Communications Messaging Server 7u4-24.01 (7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTP id <0NAX00KNMURYI410@mailout1.samsung.com> for linux-cifs@vger.kernel.org; Wed, 27 Aug 2014 09:02:22 +0900 (KST) Received: from epcpsbgm1.samsung.com ( [172.20.52.115]) by epcpsbgr1.samsung.com (EPCPMTA) with SMTP id E9.FB.02948.E002DF35; Wed, 27 Aug 2014 09:02:22 +0900 (KST) X-AuditID: cbfee68d-f79c46d000000b84-1a-53fd200e61c2 Received: from epmmp1.local.host ( [203.254.227.16]) by epcpsbgm1.samsung.com (EPCPMTA) with SMTP id C7.52.04943.E002DF35; Wed, 27 Aug 2014 09:02:22 +0900 (KST) Received: from DONAMJAEJEO06 ([10.88.104.63]) by mmp1.samsung.com (Oracle Communications Messaging Server 7u4-24.01 (7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTPA id <0NAX00MW1URYSL90@mmp1.samsung.com>; Wed, 27 Aug 2014 09:02:22 +0900 (KST) From: Namjae Jeon To: Steve French Cc: Simo , Shirish Pargaonkar , linux-cifs@vger.kernel.org, Ashish Sangwan Subject: [PATCH v2] cifs: set client time as MsvAvTimestamp from CHALLENGE_MESSAGE.TargetInfo Date: Wed, 27 Aug 2014 09:02:22 +0900 Message-id: <002501cfc18a$2d020b30$87062190$@samsung.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-index: Ac/BiSxdZJZywQ2ZSXK6gUoRKwEkQg== Content-language: ko X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprPIsWRmVeSWpSXmKPExsWyRsSkWJdP4W+wwbmvWhZLJ15itnjxfxeQ mNPAaLH82g0mizcvDrM5sHrsnHWX3WPurj5Gj74tqxg9Pm+SC2CJ4rJJSc3JLEst0rdL4Mr4 eGsHY8EbyYqTm7QaGOeJdjFyckgImEjcufiMBcIWk7hwbz1bFyMXh5DAUkaJRU+Ws8EUNba8 Z4JILGKU6F42hxXC+csoMXHGfaAMBwebgLbEny1gU0UEVCXeNU9lBrGZBSYySvx6ZgNiCwvE S1zbtxAszgJUc2/lE7DNvAKWEm/2z4SyBSV+TL7HAtGrJbF+53EmCFteYvOat8wQBylI7Dj7 mhFil57E71272SFqRCT2vXjHCHKbhMAmdonVfb3sEMsEJL5NPsQCcqeEgKzEpgNQcyQlDq64 wTKBUWwWktWzkKyehWT1LCQrFjCyrGIUTS1ILihOSi8y1CtOzC0uzUvXS87P3cQIjLfT/571 7mC8fcD6EKMAB6MSD++HBX+ChVgTy4orcw8xmgJdNJFZSjQ5HxjVeSXxhsZmRhamJqbGRuaW ZkrivIpSP4OFBNITS1KzU1MLUovii0pzUosPMTJxcEo1MG5yfXA2/NDrfzIPrZa/+6XvJ3vF 6qDhw8WnE2Q/vufS+rK4P6V+bZMd06msrK2eTlNvT7guo+P+SmeWY/fD4J8z5pfu2pT3WGK6 8tRpu3YktHdN42pUWLnnYETkv8kPz59U9t+vJG9/Yfv2c1oyuxwkbj/8Mm2Nn0tRok/0XC31 gkZ9BmlhsR9KLMUZiYZazEXFiQCirKqDsgIAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrJIsWRmVeSWpSXmKPExsVy+t9jAV0+hb/BBstPKVssnXiJ2eLF/11A Yk4Do8XyazeYLN68OMzmwOqxc9Zddo+5u/oYPfq2rGL0+LxJLoAlqoHRJiM1MSW1SCE1Lzk/ JTMv3VbJOzjeOd7UzMBQ19DSwlxJIS8xN9VWycUnQNctMwdosZJCWWJOKVAoILG4WEnfDtOE 0BA3XQuYxghd35AguB4jAzSQsIYx4+OtHYwFbyQrTm7SamCcJ9rFyMkhIWAi0djyngnCFpO4 cG89WxcjF4eQwCJGie5lc1ghnL+MEhNn3Aeq4uBgE9CW+LMFrFlEQFXiXfNUZhCbWWAio8Sv ZzYgtrBAvMS1fQvB4ixANfdWPmEBsXkFLCXe7J8JZQtK/Jh8jwWiV0ti/c7jTBC2vMTmNW+Z IQ5SkNhx9jUjxC49id+7drND1IhI7HvxjnECo8AsJKNmIRk1C8moWUhaFjCyrGIUTS1ILihO Ss811CtOzC0uzUvXS87P3cQIjuZnUjsYVzZYHGIU4GBU4uH9uOBPsBBrYllxZe4hRgkOZiUR 3h9JQCHelMTKqtSi/Pii0pzU4kOMpkCfTmSWEk3OByaavJJ4Q2MTMyNLI3NDCyNjcyVx3gOt 1oFCAumJJanZqakFqUUwfUwcnFINjNkHmHdpfrOWiVoadGTDgTVbmZ90rH/qsHZKLMuDQ7aW uQ2x/fXqz4T8OS+2xMvsYZtkLJ//oJH/8JUHRV8bOc5GmrmFTGtXFNmxa5fekqyog53LJixb vfrcMqclTnNUi/fl7bsd0Houb8H9CLm5E8MVjs38GOIVPG9h24JyLeW/Ga+fPjh/JFaJpTgj 0VCLuag4EQDVlDqH/AIAAA== DLP-Filter: Pass X-MTR: 20000000000000000@CPGS X-CFilter-Loop: Reflected Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Windows machine has extended security feature which refuse to allow authentication when there is time difference between server time and client time when ntlmv2 negotiation is used. This problem is prevalent in embedded enviornment where system time is set to default 1970. Modern servers send the server timestamp in the TargetInfo Av_Pair structure in the challenge message [see MS-NLMP 2.2.2.1] In [MS-NLMP 3.1.5.1.2] it is explicitly mentioned that the client must use the server provided timestamp if present OR current time if it is not This behavior is so far only observed for windows server and does not effect samba server. Signed-off-by: Namjae Jeon Signed-off-by: Ashish Sangwan --- fs/cifs/cifsencrypt.c | 6 ++++-- fs/cifs/cifsglob.h | 2 ++ fs/cifs/sess.c | 19 +++++++++++++++++++ 3 files changed, 25 insertions(+), 2 deletions(-) diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c index 4934347..3ec44f8 100644 --- a/fs/cifs/cifsencrypt.c +++ b/fs/cifs/cifsencrypt.c @@ -671,8 +671,10 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) (ses->auth_key.response + CIFS_SESS_KEY_SIZE); ntlmv2->blob_signature = cpu_to_le32(0x00000101); ntlmv2->reserved = 0; - /* Must be within 5 minutes of the server */ - ntlmv2->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); + if (ses->serverTime) + ntlmv2->time = ses->serverTime; + else + ntlmv2->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); get_random_bytes(&ntlmv2->client_chal, sizeof(ntlmv2->client_chal)); ntlmv2->reserved2 = 0; diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index ce24c1f..1102822 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -796,6 +796,8 @@ struct cifs_ses { enum securityEnum sectype; /* what security flavor was specified? */ bool sign; /* is signing required? */ bool need_reconnect:1; /* connection reset, uid now invalid */ + __u64 serverTime; /* Keeps a track of server time sent by server + during NTLM challenge in little endian */ #ifdef CONFIG_CIFS_SMB2 __u16 session_flags; char smb3signingkey[SMB3_SIGN_KEY_SIZE]; /* for signing smb3 packets */ diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c index 07fe97a..944750c 100644 --- a/fs/cifs/sess.c +++ b/fs/cifs/sess.c @@ -277,6 +277,24 @@ static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft, cifs_dbg(FYI, "ascii: bytes left %d\n", bleft); } +static void +get_ntlmv2_server_time(struct cifs_ses *ses) +{ + char *payload = ses->auth_key.response; + u16 AvId, AvLen; + + do { + AvId = le16_to_cpu(*payload); + AvLen = le16_to_cpu(*(payload + sizeof(u16))); + payload += AvLen + (2 * sizeof(u16)); + } while (AvId != NTLMSSP_AV_TIMESTAMP && AvId != NTLMSSP_AV_EOL); + + if (AvId == NTLMSSP_AV_TIMESTAMP) + memcpy(&(ses->serverTime), (payload - AvLen), sizeof(__u64)); + else + ses->serverTime = 0; +} + int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, struct cifs_ses *ses) { @@ -322,6 +340,7 @@ int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, return -ENOMEM; } ses->auth_key.len = tilen; + get_ntlmv2_server_time(ses); } return 0;