cifs client not forgiving enough when neg prot smb1 (with extended security)

cifs client not forgiving enough when neg prot smb1 (with extended security)

[Noel Power]

[-- Attachment #1: Type: text/plain, Size: 605 bytes --]

Hi Steve,

Just came across a situation where cifs client was failing to mount a
share with ntlmssp served by cifsd based server.
The server is misbehaving in that is should have set the
EncryptionKeyLength to zero (when offering extended security).
Regardless though, a windows client will happily continue whereas the
cifs client will return IO(5) error. Looking in the MS-SMB spec 
(2.2.4.5.2.1) mentions

"ChallengeLength (1 byte): When the CAP_EXTENDED_SECURITY bit is set,
the server MUST set this value to zero and clients MUST ignore this value."

I attach a patch to cifs for this

thanks,

Noel

[-- Attachment #2: 0001-client-MUST-ignore-EncryptionKeyLength-if-CAP_EXTEND.patch --]
[-- Type: text/plain, Size: 1305 bytes --]

From ccd99a91f3b73e4281cabd8dd84b0e46bff71865 Mon Sep 17 00:00:00 2001
From: Noel Power <noel.power@suse.com>
Date: Wed, 27 May 2015 09:22:10 +0100
Subject: [PATCH] client MUST ignore EncryptionKeyLength if
 CAP_EXTENDED_SECURITY is set

[MS-SMB] 2.2.4.5.2.1 states:

"ChallengeLength (1 byte): When the CAP_EXTENDED_SECURITY bit is set,
 the server MUST set this value to zero and clients MUST ignore this
 value."

Signed-off-by: Noel Power <noel.power@suse.com>
---
 fs/cifs/cifssmb.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 5f1f328..ea938a8 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -629,9 +629,8 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
 		server->negflavor = CIFS_NEGFLAVOR_UNENCAP;
 		memcpy(ses->server->cryptkey, pSMBr->u.EncryptionKey,
 		       CIFS_CRYPTO_KEY_SIZE);
-	} else if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC ||
-			server->capabilities & CAP_EXTENDED_SECURITY) &&
-				(pSMBr->EncryptionKeyLength == 0)) {
+	} else if (pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC ||
+			server->capabilities & CAP_EXTENDED_SECURITY) {
 		server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
 		rc = decode_ext_sec_blob(ses, pSMBr);
 	} else if (server->sec_mode & SECMODE_PW_ENCRYPT) {
-- 
1.8.5.6

Re: cifs client not forgiving enough when neg prot smb1 (with extended security)

[Steve French]

Merged into cifs-2.6.git

On Wed, May 27, 2015 at 7:06 AM, Noel Power <nopower-IBi9RG/b67k@public.gmane.org> wrote:
> Hi Steve,
>
> Just came across a situation where cifs client was failing to mount a
> share with ntlmssp served by cifsd based server.
> The server is misbehaving in that is should have set the
> EncryptionKeyLength to zero (when offering extended security).
> Regardless though, a windows client will happily continue whereas the
> cifs client will return IO(5) error. Looking in the MS-SMB spec
> (2.2.4.5.2.1) mentions
>
> "ChallengeLength (1 byte): When the CAP_EXTENDED_SECURITY bit is set,
> the server MUST set this value to zero and clients MUST ignore this value."
>
> I attach a patch to cifs for this
>
> thanks,
>
> Noel



-- 
Thanks,

Steve