Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c234aa5 authored by Shirish Pargaonkar's avatar Shirish Pargaonkar Committed by Steve French
Browse files

cifs: Add a variable specific to NTLMSSP for key exchange. 



Add a variable specific to NTLMSSP authentication to determine
whether to exchange keys during negotiation and authentication phases.

Since session key for smb1 is per smb connection, once a very first
sesion is established, there is no need for key exchange during
subsequent session setups. As a result, smb1 session setup code sets this
variable as false.

Since session key for smb2 and smb3 is per smb connection, we need to
exchange keys to generate session key for every sesion being established.
As a result, smb2/3 session setup code sets this variable as true.

Acked-by: default avatarJeff Layton <jlayton@samba.org>
Signed-off-by: default avatarShirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent d4e63bd6

fs/cifs/cifsglob.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -131,6 +131,7 @@ struct cifs_secmech { 




/* per smb session structure/fields */

/* per smb session structure/fields */

struct ntlmssp_auth {

struct ntlmssp_auth {

	bool sesskey_per_smbsess; /* whether session key is per smb session */

	__u32 client_flags; /* sent by client in type 1 ntlmsssp exchange */

	__u32 client_flags; /* sent by client in type 1 ntlmsssp exchange */

	__u32 server_flags; /* sent by server in type 2 ntlmssp exchange */

	__u32 server_flags; /* sent by server in type 2 ntlmssp exchange */

	unsigned char ciphertext[CIFS_CPHTXT_SIZE]; /* sent to server */

	unsigned char ciphertext[CIFS_CPHTXT_SIZE]; /* sent to server */

fs/cifs/sess.c

+6 −2
Original line number Original line Diff line number Diff line
@@ -428,7 +428,8 @@ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, 
		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;

		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;

	if (ses->server->sign) {

	if (ses->server->sign) {

		flags |= NTLMSSP_NEGOTIATE_SIGN;

		flags |= NTLMSSP_NEGOTIATE_SIGN;

		if (!ses->server->session_estab)

		if (!ses->server->session_estab ||

				ses->ntlmssp->sesskey_per_smbsess)

			flags |= NTLMSSP_NEGOTIATE_KEY_XCH;

			flags |= NTLMSSP_NEGOTIATE_KEY_XCH;

	}

	}
@@ -466,7 +467,8 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, 
		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;

		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;

	if (ses->server->sign) {

	if (ses->server->sign) {

		flags |= NTLMSSP_NEGOTIATE_SIGN;

		flags |= NTLMSSP_NEGOTIATE_SIGN;

		if (!ses->server->session_estab)

		if (!ses->server->session_estab ||

				ses->ntlmssp->sesskey_per_smbsess)

			flags |= NTLMSSP_NEGOTIATE_KEY_XCH;

			flags |= NTLMSSP_NEGOTIATE_KEY_XCH;

	}

	}
@@ -641,6 +643,8 @@ CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses, 
		ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);

		ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);

		if (!ses->ntlmssp)

		if (!ses->ntlmssp)

			return -ENOMEM;

			return -ENOMEM;

		ses->ntlmssp->sesskey_per_smbsess = false;



	}

	}





ssetup_ntlmssp_authenticate:

ssetup_ntlmssp_authenticate:

fs/cifs/smb2pdu.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -491,6 +491,7 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, 
	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);

	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);

	if (!ses->ntlmssp)

	if (!ses->ntlmssp)

		return -ENOMEM;

		return -ENOMEM;

	ses->ntlmssp->sesskey_per_smbsess = true;





	/* FIXME: allow for other auth types besides NTLMSSP (e.g. krb5) */

	/* FIXME: allow for other auth types besides NTLMSSP (e.g. krb5) */

	ses->sectype = RawNTLMSSP;

	ses->sectype = RawNTLMSSP;