From patchwork Tue Feb 15 23:10:43 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shirish Pargaonkar X-Patchwork-Id: 559781 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p1FNAASR026858 for ; Tue, 15 Feb 2011 23:10:11 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755093Ab1BOXKK (ORCPT ); Tue, 15 Feb 2011 18:10:10 -0500 Received: from mail-qw0-f46.google.com ([209.85.216.46]:44133 "EHLO mail-qw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755033Ab1BOXKJ (ORCPT ); Tue, 15 Feb 2011 18:10:09 -0500 Received: by qwa26 with SMTP id 26so574807qwa.19 for ; Tue, 15 Feb 2011 15:10:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer; bh=8lr+CVETcXshiVsEENWrrfeUhUdC/z8d+ftD/fHaB+k=; b=Zxvj7wfnDZIVCWkP11r2fV6mgp8Wq0cj74dujP6el7wLNPiZAiA3SaYyQmYkPo5omL OWsZvQ6ozoJ7wxFmjyqUuaXHxXzo2Z4HIHidN/ZTh5ifJxzunuE5fc0Ii1EJURbaxn63 fSYtnGY7a5TLDuKni5/x2ZgTumOr2kO8n0hs8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; b=RGpsJ2NPxjPSEvFYShnergVmsaQjSzqMw6Z99D8n1S6MXy5FPz1dZ3FPnwltARw7JV DV4Es1Qew6FRiy5ZnmUpEAuaCx/o9j7UpPOO+8cEhYWVo3Co/+cSki8ex2zLyZEHtCyi fjU4GLQQps5EPQnbNfvNrbj4EB/dgunb7YREc= Received: by 10.229.81.6 with SMTP id v6mr4659635qck.223.1297811408899; Tue, 15 Feb 2011 15:10:08 -0800 (PST) Received: from localhost ([32.97.110.58]) by mx.google.com with ESMTPS id h20sm3023942qck.0.2011.02.15.15.10.07 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 15 Feb 2011 15:10:08 -0800 (PST) From: shirishpargaonkar@gmail.com To: smfrench@gmail.com Cc: linux-cifs@vger.kernel.org, Shirish Pargaonkar Subject: [PATCH] cifs: fix broken lanman (lm) auth code Date: Tue, 15 Feb 2011 17:10:43 -0600 Message-Id: <1297811443-4848-1-git-send-email-shirishpargaonkar@gmail.com> X-Mailer: git-send-email 1.6.0.2 Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Tue, 15 Feb 2011 23:10:11 +0000 (UTC) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 17afb0f..0b5c950 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -710,7 +710,8 @@ require use of the stronger protocol */ #define CIFSSEC_MUST_SEAL 0x40040 /* not supported yet */ #define CIFSSEC_MUST_NTLMSSP 0x80080 /* raw ntlmssp with ntlmv2 */ -#define CIFSSEC_DEF (CIFSSEC_MAY_SIGN | CIFSSEC_MAY_NTLM | CIFSSEC_MAY_NTLMV2) +#define CIFSSEC_DEF (CIFSSEC_MAY_LANMAN | CIFSSEC_MAY_SIGN | \ + CIFSSEC_MAY_NTLM | CIFSSEC_MAY_NTLMV2) #define CIFSSEC_MAX (CIFSSEC_MUST_SIGN | CIFSSEC_MUST_NTLMV2) #define CIFSSEC_AUTH_MASK (CIFSSEC_MAY_NTLM | CIFSSEC_MAY_NTLMV2 | CIFSSEC_MAY_LANMAN | CIFSSEC_MAY_PLNTXT | CIFSSEC_MAY_KRB5 | CIFSSEC_MAY_NTLMSSP) /* diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 8d6c17a..e3494df 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1014,6 +1014,9 @@ cifs_parse_mount_options(char *options, const char *devname, /* BB is there a better way to do this? */ vol->secFlg |= CIFSSEC_MAY_NTLMV2; #ifdef CONFIG_CIFS_WEAK_PW_HASH + } else if (strnicmp(value, "lanmani", 7) == 0) { + vol->secFlg |= CIFSSEC_MAY_LANMAN | + CIFSSEC_MUST_SIGN; } else if (strnicmp(value, "lanman", 6) == 0) { vol->secFlg |= CIFSSEC_MAY_LANMAN; #endif diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c index 1adc962..1676570 100644 --- a/fs/cifs/sess.c +++ b/fs/cifs/sess.c @@ -656,13 +656,13 @@ ssetup_ntlmssp_authenticate: if (type == LANMAN) { #ifdef CONFIG_CIFS_WEAK_PW_HASH - char lnm_session_key[CIFS_SESS_KEY_SIZE]; + char lnm_session_key[CIFS_AUTH_RESP_SIZE]; pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE; /* no capabilities flags in old lanman negotiation */ - pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE); + pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE); /* Calculate hash with password and copy into bcc_ptr. * Encryption Key (stored as in cryptkey) gets used if the @@ -675,8 +675,8 @@ ssetup_ntlmssp_authenticate: true : false, lnm_session_key); ses->flags |= CIFS_SES_LANMAN; - memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_SESS_KEY_SIZE); - bcc_ptr += CIFS_SESS_KEY_SIZE; + memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE); + bcc_ptr += CIFS_AUTH_RESP_SIZE; /* can not sign if LANMAN negotiated so no need to calculate signing key? but what if server diff --git a/fs/cifs/smbdes.c b/fs/cifs/smbdes.c index 0472148..dcfc379 100644 --- a/fs/cifs/smbdes.c +++ b/fs/cifs/smbdes.c @@ -299,6 +299,20 @@ dohash(char *out, char *in, char *key, int forw) kfree(ki); } +static int +odd_parity(unsigned char c) +{ + int i; + int val = 0x80; + int count = 0; + + for (i = 0; i < 7; ++i) + if (c & (val >> i)) + ++count; + + return count % 2; +} + static void str_to_key(unsigned char *str, unsigned char *key) { @@ -312,8 +326,11 @@ str_to_key(unsigned char *str, unsigned char *key) key[5] = ((str[4] & 0x1F) << 2) | (str[5] >> 6); key[6] = ((str[5] & 0x3F) << 1) | (str[6] >> 7); key[7] = str[6] & 0x7F; - for (i = 0; i < 8; i++) + for (i = 0; i < 8; i++) { key[i] = (key[i] << 1); + if (!odd_parity(key[i])) + key[i] |= 0x1; + } } static void