Skip to content

Commit e25ca04

Browse files
torvaldstorvalds
committed
Merge tag '5.15-rc3-ksmbd-fixes' of git://git.samba.org/ksmbd
Pull ksmbd server fixes from Steve French: "Eleven fixes for the ksmbd kernel server, mostly security related: - an important fix for disabling weak NTLMv1 authentication - seven security (improved buffer overflow checks) fixes - fix for wrong infolevel struct used in some getattr/setattr paths - two small documentation fixes" * tag '5.15-rc3-ksmbd-fixes' of git://git.samba.org/ksmbd: ksmbd: missing check for NULL in convert_to_nt_pathname() ksmbd: fix transform header validation ksmbd: add buffer validation for SMB2_CREATE_CONTEXT ksmbd: add validation in smb2 negotiate ksmbd: add request buffer validation in smb2_set_info ksmbd: use correct basic info level in set_file_basic_info() ksmbd: remove NTLMv1 authentication ksmbd: fix documentation for 2 functions MAINTAINERS: rename cifs_common to smbfs_common in cifs and ksmbd entry ksmbd: fix invalid request buffer access in compound ksmbd: remove RFC1002 check in smb2 request
2 parents 9904468 + 87ffb31 commit e25ca04

File tree

12 files changed

+294
-342
lines changed

12 files changed

+294
-342
lines changed

‎MAINTAINERS

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4657,7 +4657,7 @@ W: http://linux-cifs.samba.org/
46574657
T: git git://git.samba.org/sfrench/cifs-2.6.git
46584658
F: Documentation/admin-guide/cifs/
46594659
F: fs/cifs/
4660-
F: fs/cifs_common/
4660+
F: fs/smbfs_common/
46614661

46624662
COMPACTPCI HOTPLUG CORE
46634663
M: Scott Murray <[email protected]>
@@ -10195,8 +10195,8 @@ M: Hyunchul Lee <[email protected]>
1019510195
L: [email protected]
1019610196
S: Maintained
1019710197
T: git git://git.samba.org/ksmbd.git
10198-
F: fs/cifs_common/
1019910198
F: fs/ksmbd/
10199+
F: fs/smbfs_common/
1020010200

1020110201
KERNEL UNIT TESTING FRAMEWORK (KUnit)
1020210202
M: Brendan Higgins <[email protected]>

‎fs/ksmbd/auth.c

Lines changed: 0 additions & 205 deletions
Original file line numberDiff line numberDiff line change
@@ -68,125 +68,6 @@ void ksmbd_copy_gss_neg_header(void *buf)
6868
memcpy(buf, NEGOTIATE_GSS_HEADER, AUTH_GSS_LENGTH);
6969
}
7070

71-
static void
72-
str_to_key(unsigned char *str, unsigned char *key)
73-
{
74-
int i;
75-
76-
key[0] = str[0] >> 1;
77-
key[1] = ((str[0] & 0x01) << 6) | (str[1] >> 2);
78-
key[2] = ((str[1] & 0x03) << 5) | (str[2] >> 3);
79-
key[3] = ((str[2] & 0x07) << 4) | (str[3] >> 4);
80-
key[4] = ((str[3] & 0x0F) << 3) | (str[4] >> 5);
81-
key[5] = ((str[4] & 0x1F) << 2) | (str[5] >> 6);
82-
key[6] = ((str[5] & 0x3F) << 1) | (str[6] >> 7);
83-
key[7] = str[6] & 0x7F;
84-
for (i = 0; i < 8; i++)
85-
key[i] = (key[i] << 1);
86-
}
87-
88-
static int
89-
smbhash(unsigned char *out, const unsigned char *in, unsigned char *key)
90-
{
91-
unsigned char key2[8];
92-
struct des_ctx ctx;
93-
94-
if (fips_enabled) {
95-
ksmbd_debug(AUTH, "FIPS compliance enabled: DES not permitted\n");
96-
return -ENOENT;
97-
}
98-
99-
str_to_key(key, key2);
100-
des_expand_key(&ctx, key2, DES_KEY_SIZE);
101-
des_encrypt(&ctx, out, in);
102-
memzero_explicit(&ctx, sizeof(ctx));
103-
return 0;
104-
}
105-
106-
static int ksmbd_enc_p24(unsigned char *p21, const unsigned char *c8, unsigned char *p24)
107-
{
108-
int rc;
109-
110-
rc = smbhash(p24, c8, p21);
111-
if (rc)
112-
return rc;
113-
rc = smbhash(p24 + 8, c8, p21 + 7);
114-
if (rc)
115-
return rc;
116-
return smbhash(p24 + 16, c8, p21 + 14);
117-
}
118-
119-
/* produce a md4 message digest from data of length n bytes */
120-
static int ksmbd_enc_md4(unsigned char *md4_hash, unsigned char *link_str,
121-
int link_len)
122-
{
123-
int rc;
124-
struct ksmbd_crypto_ctx *ctx;
125-
126-
ctx = ksmbd_crypto_ctx_find_md4();
127-
if (!ctx) {
128-
ksmbd_debug(AUTH, "Crypto md4 allocation error\n");
129-
return -ENOMEM;
130-
}
131-
132-
rc = crypto_shash_init(CRYPTO_MD4(ctx));
133-
if (rc) {
134-
ksmbd_debug(AUTH, "Could not init md4 shash\n");
135-
goto out;
136-
}
137-
138-
rc = crypto_shash_update(CRYPTO_MD4(ctx), link_str, link_len);
139-
if (rc) {
140-
ksmbd_debug(AUTH, "Could not update with link_str\n");
141-
goto out;
142-
}
143-
144-
rc = crypto_shash_final(CRYPTO_MD4(ctx), md4_hash);
145-
if (rc)
146-
ksmbd_debug(AUTH, "Could not generate md4 hash\n");
147-
out:
148-
ksmbd_release_crypto_ctx(ctx);
149-
return rc;
150-
}
151-
152-
static int ksmbd_enc_update_sess_key(unsigned char *md5_hash, char *nonce,
153-
char *server_challenge, int len)
154-
{
155-
int rc;
156-
struct ksmbd_crypto_ctx *ctx;
157-
158-
ctx = ksmbd_crypto_ctx_find_md5();
159-
if (!ctx) {
160-
ksmbd_debug(AUTH, "Crypto md5 allocation error\n");
161-
return -ENOMEM;
162-
}
163-
164-
rc = crypto_shash_init(CRYPTO_MD5(ctx));
165-
if (rc) {
166-
ksmbd_debug(AUTH, "Could not init md5 shash\n");
167-
goto out;
168-
}
169-
170-
rc = crypto_shash_update(CRYPTO_MD5(ctx), server_challenge, len);
171-
if (rc) {
172-
ksmbd_debug(AUTH, "Could not update with challenge\n");
173-
goto out;
174-
}
175-
176-
rc = crypto_shash_update(CRYPTO_MD5(ctx), nonce, len);
177-
if (rc) {
178-
ksmbd_debug(AUTH, "Could not update with nonce\n");
179-
goto out;
180-
}
181-
182-
rc = crypto_shash_final(CRYPTO_MD5(ctx), md5_hash);
183-
if (rc)
184-
ksmbd_debug(AUTH, "Could not generate md5 hash\n");
185-
out:
186-
ksmbd_release_crypto_ctx(ctx);
187-
return rc;
188-
}
189-
19071
/**
19172
* ksmbd_gen_sess_key() - function to generate session key
19273
* @sess: session of connection
@@ -324,43 +205,6 @@ static int calc_ntlmv2_hash(struct ksmbd_session *sess, char *ntlmv2_hash,
324205
return ret;
325206
}
326207

327-
/**
328-
* ksmbd_auth_ntlm() - NTLM authentication handler
329-
* @sess: session of connection
330-
* @pw_buf: NTLM challenge response
331-
* @passkey: user password
332-
*
333-
* Return: 0 on success, error number on error
334-
*/
335-
int ksmbd_auth_ntlm(struct ksmbd_session *sess, char *pw_buf)
336-
{
337-
int rc;
338-
unsigned char p21[21];
339-
char key[CIFS_AUTH_RESP_SIZE];
340-
341-
memset(p21, '\0', 21);
342-
memcpy(p21, user_passkey(sess->user), CIFS_NTHASH_SIZE);
343-
rc = ksmbd_enc_p24(p21, sess->ntlmssp.cryptkey, key);
344-
if (rc) {
345-
pr_err("password processing failed\n");
346-
return rc;
347-
}
348-
349-
ksmbd_enc_md4(sess->sess_key, user_passkey(sess->user),
350-
CIFS_SMB1_SESSKEY_SIZE);
351-
memcpy(sess->sess_key + CIFS_SMB1_SESSKEY_SIZE, key,
352-
CIFS_AUTH_RESP_SIZE);
353-
sess->sequence_number = 1;
354-
355-
if (strncmp(pw_buf, key, CIFS_AUTH_RESP_SIZE) != 0) {
356-
ksmbd_debug(AUTH, "ntlmv1 authentication failed\n");
357-
return -EINVAL;
358-
}
359-
360-
ksmbd_debug(AUTH, "ntlmv1 authentication pass\n");
361-
return 0;
362-
}
363-
364208
/**
365209
* ksmbd_auth_ntlmv2() - NTLMv2 authentication handler
366210
* @sess: session of connection
@@ -441,44 +285,6 @@ int ksmbd_auth_ntlmv2(struct ksmbd_session *sess, struct ntlmv2_resp *ntlmv2,
441285
return rc;
442286
}
443287

444-
/**
445-
* __ksmbd_auth_ntlmv2() - NTLM2(extended security) authentication handler
446-
* @sess: session of connection
447-
* @client_nonce: client nonce from LM response.
448-
* @ntlm_resp: ntlm response data from client.
449-
*
450-
* Return: 0 on success, error number on error
451-
*/
452-
static int __ksmbd_auth_ntlmv2(struct ksmbd_session *sess, char *client_nonce,
453-
char *ntlm_resp)
454-
{
455-
char sess_key[CIFS_SMB1_SESSKEY_SIZE] = {0};
456-
int rc;
457-
unsigned char p21[21];
458-
char key[CIFS_AUTH_RESP_SIZE];
459-
460-
rc = ksmbd_enc_update_sess_key(sess_key,
461-
client_nonce,
462-
(char *)sess->ntlmssp.cryptkey, 8);
463-
if (rc) {
464-
pr_err("password processing failed\n");
465-
goto out;
466-
}
467-
468-
memset(p21, '\0', 21);
469-
memcpy(p21, user_passkey(sess->user), CIFS_NTHASH_SIZE);
470-
rc = ksmbd_enc_p24(p21, sess_key, key);
471-
if (rc) {
472-
pr_err("password processing failed\n");
473-
goto out;
474-
}
475-
476-
if (memcmp(ntlm_resp, key, CIFS_AUTH_RESP_SIZE) != 0)
477-
rc = -EINVAL;
478-
out:
479-
return rc;
480-
}
481-
482288
/**
483289
* ksmbd_decode_ntlmssp_auth_blob() - helper function to construct
484290
* authenticate blob
@@ -512,17 +318,6 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
512318
nt_off = le32_to_cpu(authblob->NtChallengeResponse.BufferOffset);
513319
nt_len = le16_to_cpu(authblob->NtChallengeResponse.Length);
514320

515-
/* process NTLM authentication */
516-
if (nt_len == CIFS_AUTH_RESP_SIZE) {
517-
if (le32_to_cpu(authblob->NegotiateFlags) &
518-
NTLMSSP_NEGOTIATE_EXTENDED_SEC)
519-
return __ksmbd_auth_ntlmv2(sess, (char *)authblob +
520-
lm_off, (char *)authblob + nt_off);
521-
else
522-
return ksmbd_auth_ntlm(sess, (char *)authblob +
523-
nt_off);
524-
}
525-
526321
/* TODO : use domain name that imported from configuration file */
527322
domain_name = smb_strndup_from_utf16((const char *)authblob +
528323
le32_to_cpu(authblob->DomainName.BufferOffset),

‎fs/ksmbd/crypto_ctx.c

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -81,12 +81,6 @@ static struct shash_desc *alloc_shash_desc(int id)
8181
case CRYPTO_SHASH_SHA512:
8282
tfm = crypto_alloc_shash("sha512", 0, 0);
8383
break;
84-
case CRYPTO_SHASH_MD4:
85-
tfm = crypto_alloc_shash("md4", 0, 0);
86-
break;
87-
case CRYPTO_SHASH_MD5:
88-
tfm = crypto_alloc_shash("md5", 0, 0);
89-
break;
9084
default:
9185
return NULL;
9286
}
@@ -214,16 +208,6 @@ struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha512(void)
214208
return ____crypto_shash_ctx_find(CRYPTO_SHASH_SHA512);
215209
}
216210

217-
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md4(void)
218-
{
219-
return ____crypto_shash_ctx_find(CRYPTO_SHASH_MD4);
220-
}
221-
222-
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md5(void)
223-
{
224-
return ____crypto_shash_ctx_find(CRYPTO_SHASH_MD5);
225-
}
226-
227211
static struct ksmbd_crypto_ctx *____crypto_aead_ctx_find(int id)
228212
{
229213
struct ksmbd_crypto_ctx *ctx;

‎fs/ksmbd/crypto_ctx.h

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@ enum {
1515
CRYPTO_SHASH_CMACAES,
1616
CRYPTO_SHASH_SHA256,
1717
CRYPTO_SHASH_SHA512,
18-
CRYPTO_SHASH_MD4,
19-
CRYPTO_SHASH_MD5,
2018
CRYPTO_SHASH_MAX,
2119
};
2220

@@ -43,17 +41,13 @@ struct ksmbd_crypto_ctx {
4341
#define CRYPTO_CMACAES(c) ((c)->desc[CRYPTO_SHASH_CMACAES])
4442
#define CRYPTO_SHA256(c) ((c)->desc[CRYPTO_SHASH_SHA256])
4543
#define CRYPTO_SHA512(c) ((c)->desc[CRYPTO_SHASH_SHA512])
46-
#define CRYPTO_MD4(c) ((c)->desc[CRYPTO_SHASH_MD4])
47-
#define CRYPTO_MD5(c) ((c)->desc[CRYPTO_SHASH_MD5])
4844

4945
#define CRYPTO_HMACMD5_TFM(c) ((c)->desc[CRYPTO_SHASH_HMACMD5]->tfm)
5046
#define CRYPTO_HMACSHA256_TFM(c)\
5147
((c)->desc[CRYPTO_SHASH_HMACSHA256]->tfm)
5248
#define CRYPTO_CMACAES_TFM(c) ((c)->desc[CRYPTO_SHASH_CMACAES]->tfm)
5349
#define CRYPTO_SHA256_TFM(c) ((c)->desc[CRYPTO_SHASH_SHA256]->tfm)
5450
#define CRYPTO_SHA512_TFM(c) ((c)->desc[CRYPTO_SHASH_SHA512]->tfm)
55-
#define CRYPTO_MD4_TFM(c) ((c)->desc[CRYPTO_SHASH_MD4]->tfm)
56-
#define CRYPTO_MD5_TFM(c) ((c)->desc[CRYPTO_SHASH_MD5]->tfm)
5751

5852
#define CRYPTO_GCM(c) ((c)->ccmaes[CRYPTO_AEAD_AES_GCM])
5953
#define CRYPTO_CCM(c) ((c)->ccmaes[CRYPTO_AEAD_AES_CCM])
@@ -64,8 +58,6 @@ struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_hmacsha256(void);
6458
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_cmacaes(void);
6559
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha512(void);
6660
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha256(void);
67-
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md4(void);
68-
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md5(void);
6961
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_gcm(void);
7062
struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_ccm(void);
7163
void ksmbd_crypto_destroy(void);

‎fs/ksmbd/misc.c

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -162,17 +162,14 @@ char *convert_to_nt_pathname(char *filename)
162162
{
163163
char *ab_pathname;
164164

165-
if (strlen(filename) == 0) {
166-
ab_pathname = kmalloc(2, GFP_KERNEL);
167-
ab_pathname[0] = '\\';
168-
ab_pathname[1] = '\0';
169-
} else {
170-
ab_pathname = kstrdup(filename, GFP_KERNEL);
171-
if (!ab_pathname)
172-
return NULL;
165+
if (strlen(filename) == 0)
166+
filename = "\\";
173167

174-
ksmbd_conv_path_to_windows(ab_pathname);
175-
}
168+
ab_pathname = kstrdup(filename, GFP_KERNEL);
169+
if (!ab_pathname)
170+
return NULL;
171+
172+
ksmbd_conv_path_to_windows(ab_pathname);
176173
return ab_pathname;
177174
}
178175

0 commit comments

Comments
 (0)