From patchwork Thu Mar 22 02:02:22 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve French X-Patchwork-Id: 10300729 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 29DA1600CC for ; Thu, 22 Mar 2018 02:03:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5FD9C28CCB for ; Thu, 22 Mar 2018 02:02:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 53A5028CED; Thu, 22 Mar 2018 02:02:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, T_TVD_MIME_EPI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9A2F028CCB for ; Thu, 22 Mar 2018 02:02:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754041AbeCVCCp (ORCPT ); Wed, 21 Mar 2018 22:02:45 -0400 Received: from mail-pg0-f68.google.com ([74.125.83.68]:44675 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753342AbeCVCCo (ORCPT ); Wed, 21 Mar 2018 22:02:44 -0400 Received: by mail-pg0-f68.google.com with SMTP id v26so178606pge.11; Wed, 21 Mar 2018 19:02:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Sd25DoWet2f2QV3vbsMh6k6hyFl5NfRkLhLVTdn3lrY=; b=efesvOJSjtNvwRo1SgGVPXz0ddOS2kf6DShwHxrZYiEtoda4uEpk6Jrx9N1KSdchM7 dOtSvwRXiH0IAWtVw9qRAzxhfiwTFJSzKzO37ld4rOds3vbVXA4uodTASI+M81Oo80Nf RID0iEidHX8c/U6G4NBEKB1PCq0lOWc3yzBASqxyhYcympza6Qr+9xIssbMJYOwf7dso bT6f7vPxQQtbbYUIG5y9DFgF+CrXceGHTAdp8lE0Ja+ZuJ4eHJ2i2nATh+VAenezOUAv rcgORIIMmp/QqTe+mnNGhZ0L6akLpg0u83TzcAZjmkYYFQswpFQIUaaJQCnlnOWpMQwH kxDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Sd25DoWet2f2QV3vbsMh6k6hyFl5NfRkLhLVTdn3lrY=; b=ghYzDyZQRGp6EfK4OgH/6wQJihsPivPsvKztBWG4DAZoTlLB5vnmjHRv+xmc0cHov0 iXE5yBVza9cx6rInZuGC3Lvw6ZAJd50zqzp3NihEYXruqAH2tzWfnGponJd2gvIYsQVH hMdSxSDGGmm9y/gh3I52HPLGW3HGT9NOvvDn3auaBKlc8lPOnths5CQVCAnFclxK7mVB et3P3RQsFPrwmD3t2gBllFtyss6VOoaBjDMW1DMuE+xSulKvFQZUVcPfwyaiH61HHJ9b E69uJEcVviV9S1dl/pDQl8Hc4tdnDJ8cPJXp8ujwF6JiiVwFT17UrDGjWY5X4fr6T//k pM2g== X-Gm-Message-State: AElRT7GtQNsvC/RAUrNdjzpDLqgYLkPKFs8Ll1HGToB70/yVNYRF8Ote GyoG5tH7RjGph2CCWOTAhHta0uBA20pVupWUSZk= X-Google-Smtp-Source: AG47ELsXRYeppvbAW/UFRKdrTp/Oui1ImYx2mNdqdQiv38gdS2OBUFFebmQquFNq4WFRcZJagTN8QxIUL1+RocmIN40= X-Received: by 10.98.147.27 with SMTP id b27mr18904711pfe.145.1521684163767; Wed, 21 Mar 2018 19:02:43 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.152.97 with HTTP; Wed, 21 Mar 2018 19:02:22 -0700 (PDT) In-Reply-To: <20180316133241.GC11397@kroah.com> References: <28ffc363-5140-5685-d288-6e3dc07c6369@csail.mit.edu> <20180227085428.GA16879@kroah.com> <20180227124050.GB31888@kroah.com> <6bca5a97-f581-86b8-12ad-77147619d519@csail.mit.edu> <309db6c4-7e21-bfbe-44d4-eb41f5516d5e@csail.mit.edu> <20180313092133.GA13325@kroah.com> <20180316133241.GC11397@kroah.com> From: Steve French Date: Wed, 21 Mar 2018 21:02:22 -0500 Message-ID: Subject: Re: [PATCH 4.13 28/43] SMB3: Validate negotiate request must always be signed To: Greg Kroah-Hartman Cc: "Srivatsa S. Bhat" , Thomas Backlund , =?UTF-8?Q?Aur=C3=A9lien_Aptel?= , LKML , Stable , Ronnie Sahlberg , Pavel Shilovskiy , CIFS Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Found a patch which solves the dependency issue. In my testing (on 4.9, with Windows 2016, and also to Samba) as Pavel suggested this appears to fix the problem, but I will let Srivatsa confirm that it also fixes it for him. The two attached patches for 4.9 should work. As an aside which may help some in testing stable true problems (as a point of comparison or alternative), I did a complete backport of all relevant CIFS/SMB3 patches (ie all patches to cifs.ko that are not dependent on a VFS changes or global kernel API changes) for kernels 4.9 through 4.15 https://github.com/smfrench/smb3-cifs-linux-stable-backports The individual patches that were included (and in a distinct directory all cifs patches that were rejected due to global/VFS dependencies) are also checked in - https://github.com/smfrench/smb3-backported-patches. Given the focus on security, these two git trees may be useful for those who want a cifs.ko which includes all security and functional improvements and fixes that more closely matches mainline cifs.ko Srivatsa, Let us know if those two patches fix your issue as expected. On Fri, Mar 16, 2018 at 8:32 AM, Greg Kroah-Hartman wrote: > On Tue, Mar 13, 2018 at 10:21:45AM -0500, Steve French wrote: >> There will be a fix needed to correct an oops in calc_signature, >> besides the easy patch (smb3 validate negotiate patch). > > Ok, I still have no idea how to parse this for a stable tree submission. > > So can someone please just send me a simple "apply these git ids to tree > X.X.y so we can fix the problem", otherwise I'm not going to do anything > here as I'm really confused, > > greg k-h From c5346223ca952a2868bd69a8888133251e517571 Mon Sep 17 00:00:00 2001 From: Pavel Shilovsky Date: Mon, 7 Nov 2016 18:20:50 -0800 Subject: [PATCH 2/2] CIFS: Enable encryption during session setup phase In order to allow encryption on SMB connection we need to exchange a session key and generate encryption and decryption keys. Signed-off-by: Pavel Shilovsky --- fs/cifs/sess.c | 22 ++++++++++------------ fs/cifs/smb2pdu.c | 12 ++---------- 2 files changed, 12 insertions(+), 22 deletions(-) diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c index 538d9b55699a..c3db2a882aee 100644 --- a/fs/cifs/sess.c +++ b/fs/cifs/sess.c @@ -344,13 +344,12 @@ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, /* BB is NTLMV2 session security format easier to use here? */ flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | - NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; - if (ses->server->sign) { + NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | + NTLMSSP_NEGOTIATE_SEAL; + if (ses->server->sign) flags |= NTLMSSP_NEGOTIATE_SIGN; - if (!ses->server->session_estab || - ses->ntlmssp->sesskey_per_smbsess) - flags |= NTLMSSP_NEGOTIATE_KEY_XCH; - } + if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) + flags |= NTLMSSP_NEGOTIATE_KEY_XCH; sec_blob->NegotiateFlags = cpu_to_le32(flags); @@ -407,13 +406,12 @@ int build_ntlmssp_auth_blob(unsigned char **pbuffer, flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | - NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; - if (ses->server->sign) { + NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | + NTLMSSP_NEGOTIATE_SEAL; + if (ses->server->sign) flags |= NTLMSSP_NEGOTIATE_SIGN; - if (!ses->server->session_estab || - ses->ntlmssp->sesskey_per_smbsess) - flags |= NTLMSSP_NEGOTIATE_KEY_XCH; - } + if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) + flags |= NTLMSSP_NEGOTIATE_KEY_XCH; tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE); sec_blob->NegotiateFlags = cpu_to_le32(flags); diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 4c2eaf05a6a4..7c26286a525d 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -707,15 +707,13 @@ SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) struct cifs_ses *ses = sess_data->ses; mutex_lock(&ses->server->srv_mutex); - if (ses->server->sign && ses->server->ops->generate_signingkey) { + if (ses->server->ops->generate_signingkey) { rc = ses->server->ops->generate_signingkey(ses); - kfree(ses->auth_key.response); - ses->auth_key.response = NULL; if (rc) { cifs_dbg(FYI, "SMB3 session key generation failed\n"); mutex_unlock(&ses->server->srv_mutex); - goto keygen_exit; + return rc; } } if (!ses->server->session_estab) { @@ -729,12 +727,6 @@ SMB2_sess_establish_session(struct SMB2_sess_data *sess_data) ses->status = CifsGood; ses->need_reconnect = false; spin_unlock(&GlobalMid_Lock); - -keygen_exit: - if (!ses->server->sign) { - kfree(ses->auth_key.response); - ses->auth_key.response = NULL; - } return rc; } -- 2.14.1