From patchwork Mon Aug 25 05:29:44 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Namjae Jeon X-Patchwork-Id: 4772551 Return-Path: X-Original-To: patchwork-cifs-client@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id E17C89F3B4 for ; Mon, 25 Aug 2014 05:29:58 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 17FAC20121 for ; Mon, 25 Aug 2014 05:29:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B22D920108 for ; Mon, 25 Aug 2014 05:29:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753441AbaHYF34 (ORCPT ); Mon, 25 Aug 2014 01:29:56 -0400 Received: from mailout3.samsung.com ([203.254.224.33]:56111 "EHLO mailout3.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753430AbaHYF3z (ORCPT ); Mon, 25 Aug 2014 01:29:55 -0400 Received: from epcpsbgr5.samsung.com (u145.gpu120.samsung.co.kr [203.254.230.145]) by mailout3.samsung.com (Oracle Communications Messaging Server 7u4-24.01 (7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTP id <0NAU002UDKLLPHC0@mailout3.samsung.com> for linux-cifs@vger.kernel.org; Mon, 25 Aug 2014 14:29:45 +0900 (KST) Received: from epcpsbgm1.samsung.com ( [172.20.52.115]) by epcpsbgr5.samsung.com (EPCPMTA) with SMTP id BB.9C.04513.8C9CAF35; Mon, 25 Aug 2014 14:29:44 +0900 (KST) X-AuditID: cbfee691-f79546d0000011a1-da-53fac9c8c971 Received: from epmmp1.local.host ( [203.254.227.16]) by epcpsbgm1.samsung.com (EPCPMTA) with SMTP id 7E.CC.04943.8C9CAF35; Mon, 25 Aug 2014 14:29:44 +0900 (KST) Received: from DONAMJAEJEO06 ([10.88.104.63]) by mmp1.samsung.com (Oracle Communications Messaging Server 7u4-24.01 (7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTPA id <0NAU00H6CKLKNC00@mmp1.samsung.com>; Mon, 25 Aug 2014 14:29:44 +0900 (KST) From: Namjae Jeon To: Steve French Cc: Simo , linux-cifs@vger.kernel.org, Jeff Layton , Ashish Sangwan Subject: [PATCH] cifs: set client time as MsvAvTimestamp from CHALLENGE_MESSAGE.TargetInfo Date: Mon, 25 Aug 2014 14:29:44 +0900 Message-id: <001301cfc025$940767f0$bc1637d0$@samsung.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-index: Ac+/8iOBf8WuhjBaReq/Qce3eRFqDg== Content-language: ko X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprHIsWRmVeSWpSXmKPExsWyRsSkWPfEyV/BBpd22VgsnXiJ2WL1zCvM Fi/+72K2WH7tBpPFmxeH2RxYPXbOusvuMXdXH6NH35ZVjB6fN8kFsERx2aSk5mSWpRbp2yVw Zby5spC94LJkxaV3k1gaGHtFuxg5OSQETCSOrZvMCGGLSVy4t56ti5GLQ0hgKaNEw4HfbDBF R3sesUMkFjFKdE//xgjh/GWUOPb7B1AVBwebgLbEny1gU0UEVCXeNU9lBrGZBRoYJSbuiQCx hQViJE4tWc4OUs4CVLNuuR1ImFfAUmJb/2k2CFtQ4sfkeywQrVoS63ceZ4Kw5SU2r3nLDHGP gsSOs68ZIVbpSRzcd4wNokZEYt+Ld1DPbGOX2DlFEsRmERCQ+Db5EAvIWgkBWYlNB6DGSEoc XHGDZQKj2Cwkm2ch2TwLyeZZSDYsYGRZxSiaWpBcUJyUXmSqV5yYW1yal66XnJ+7iREYbaf/ PZu4g/H+AetDjAIcjEo8vCs4fwULsSaWFVfmHmI0BbpoIrOUaHI+MKbzSuINjc2MLExNTI2N zC3NlMR5daR/BgsJpCeWpGanphakFsUXleakFh9iZOLglGpgzDxsLKT61c108xrzV783q+7o mZd7KTNF8ab7bLaJs6bnWW4suVzxKO+DzZmNj3JqN7ldnjg55myW9K3CmcrOfofYFR0NRaNv XTn7aPlZ02Vny5an/QoPNquLC00tKLjneuCck6rNwqIDRavqt2+eUcc07w+7qltj4OU+sxaf vttX+FL79s87p8RSnJFoqMVcVJwIAJooNTaxAgAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrJIsWRmVeSWpSXmKPExsVy+t9jAd0TJ38FG7zcbWKxdOIlZovVM68w W7z4v4vZYvm1G0wWb14cZnNg9dg56y67x9xdfYwefVtWMXp83iQXwBLVwGiTkZqYklqkkJqX nJ+SmZduq+QdHO8cb2pmYKhraGlhrqSQl5ibaqvk4hOg65aZA7RYSaEsMacUKBSQWFyspG+H aUJoiJuuBUxjhK5vSBBcj5EBGkhYw5jx5spC9oLLkhWX3k1iaWDsFe1i5OSQEDCRONrziB3C FpO4cG89WxcjF4eQwCJGie7p3xghnL+MEsd+/wDKcHCwCWhL/NkC1iwioCrxrnkqM4jNLNDA KDFxTwSILSwQI3FqyXJ2kHIWoJp1y+1AwrwClhLb+k+zQdiCEj8m32OBaNWSWL/zOBOELS+x ec1bZoh7FCR2nH3NCLFKT+LgvmNsEDUiEvtevGOcwCgwC8moWUhGzUIyahaSlgWMLKsYRVML kguKk9JzDfWKE3OLS/PS9ZLzczcxgqP5mdQOxpUNFocYBTgYlXh4V3L+ChZiTSwrrsw9xCjB wawkwjvlOFCINyWxsiq1KD++qDQntfgQoynQoxOZpUST84GJJq8k3tDYxMzI0sjc0MLI2FxJ nPdAq3WgkEB6YklqdmpqQWoRTB8TB6dUA+PM1ekXT6mHy5SvNpcX07ynkc00t+Vmz99NSoke E6OPr21kulokx5uiuk6v5YaVdXLbgjrRY8sWPfY9O5P5+0vHZVfZS6siQ19LZNudn5hUL/14 aoWXfNesOLeoVK5bJ59wOHlrp0hdjMpaeGHpUiPBgy8XPbA927ExyKz8T8P/rY8tt4l73FVi Kc5INNRiLipOBADUC85m/AIAAA== DLP-Filter: Pass X-MTR: 20000000000000000@CPGS X-CFilter-Loop: Reflected Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Windows machine has extended security feature which refuse to allow authentication when there is time difference between server time and client time when ntlmv2 negotiation is used. This problem is prevalent in embedded enviornment where system time is set to default 1970. Modern servers send the server timestamp in the TargetInfo Av_Pair structure in the challenge message [see MS-NLMP 2.2.2.1] In [MS-NLMP 3.1.5.1.2] it is explicitly mentioned that the client must use the server provided timestamp if present OR current time if it is not. Cc: Simo Signed-off-by: Namjae Jeon Signed-off-by: Ashish Sangwan --- fs/cifs/cifsencrypt.c | 6 ++++-- fs/cifs/cifsglob.h | 2 ++ fs/cifs/sess.c | 21 +++++++++++++++++++++ 3 files changed, 27 insertions(+), 2 deletions(-) diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c index 4934347..3ec44f8 100644 --- a/fs/cifs/cifsencrypt.c +++ b/fs/cifs/cifsencrypt.c @@ -671,8 +671,10 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) (ses->auth_key.response + CIFS_SESS_KEY_SIZE); ntlmv2->blob_signature = cpu_to_le32(0x00000101); ntlmv2->reserved = 0; - /* Must be within 5 minutes of the server */ - ntlmv2->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); + if (ses->serverTime) + ntlmv2->time = ses->serverTime; + else + ntlmv2->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); get_random_bytes(&ntlmv2->client_chal, sizeof(ntlmv2->client_chal)); ntlmv2->reserved2 = 0; diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index ce24c1f..1102822 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -796,6 +796,8 @@ struct cifs_ses { enum securityEnum sectype; /* what security flavor was specified? */ bool sign; /* is signing required? */ bool need_reconnect:1; /* connection reset, uid now invalid */ + __u64 serverTime; /* Keeps a track of server time sent by server + during NTLM challenge in little endian */ #ifdef CONFIG_CIFS_SMB2 __u16 session_flags; char smb3signingkey[SMB3_SIGN_KEY_SIZE]; /* for signing smb3 packets */ diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c index 07fe97a..0762377 100644 --- a/fs/cifs/sess.c +++ b/fs/cifs/sess.c @@ -277,6 +277,26 @@ static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft, cifs_dbg(FYI, "ascii: bytes left %d\n", bleft); } +static void +get_ntlmv2_server_time(struct cifs_ses *ses) +{ +#define MsvAvEOL 0x0000 +#define MsvAvTimestamp 0x0007 + char *payload = ses->auth_key.response; + u16 AvId, AvLen; + + do { + AvId = le16_to_cpu(*payload); + AvLen = le16_to_cpu(*(payload + sizeof(u16))); + payload += AvLen + (2 * sizeof(u16)); + } while (AvId != MsvAvTimestamp && AvId != MsvAvEOL); + + if (AvId == MsvAvTimestamp) + memcpy(&(ses->serverTime), (payload - AvLen), sizeof(__u64)); + else + ses->serverTime = 0; +} + int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, struct cifs_ses *ses) { @@ -322,6 +342,7 @@ int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, return -ENOMEM; } ses->auth_key.len = tilen; + get_ntlmv2_server_time(ses); } return 0;