Hi Steve,
Just came across a situation where cifs client was failing to mount a
share with ntlmssp served by cifsd based server.
The server is misbehaving in that is should have set the
EncryptionKeyLength to zero (when offering extended security).
Regardless though, a windows client will happily continue whereas the
cifs client will return IO(5) error. Looking in the MS-SMB spec
(2.2.4.5.2.1) mentions
"ChallengeLength (1 byte): When the CAP_EXTENDED_SECURITY bit is set,
the server MUST set this value to zero and clients MUST ignore this value."
I attach a patch to cifs for this
thanks,
Noel
From ccd99a91f3b73e4281cabd8dd84b0e46bff71865 Mon Sep 17 00:00:00 2001
From: Noel Power <noel.power@xxxxxxxx>
Date: Wed, 27 May 2015 09:22:10 +0100
Subject: [PATCH] client MUST ignore EncryptionKeyLength if
CAP_EXTENDED_SECURITY is set
[MS-SMB] 2.2.4.5.2.1 states:
"ChallengeLength (1 byte): When the CAP_EXTENDED_SECURITY bit is set,
the server MUST set this value to zero and clients MUST ignore this
value."
Signed-off-by: Noel Power <noel.power@xxxxxxxx>
---
fs/cifs/cifssmb.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 5f1f328..ea938a8 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -629,9 +629,8 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
server->negflavor = CIFS_NEGFLAVOR_UNENCAP;
memcpy(ses->server->cryptkey, pSMBr->u.EncryptionKey,
CIFS_CRYPTO_KEY_SIZE);
- } else if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC ||
- server->capabilities & CAP_EXTENDED_SECURITY) &&
- (pSMBr->EncryptionKeyLength == 0)) {
+ } else if (pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC ||
+ server->capabilities & CAP_EXTENDED_SECURITY) {
server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
rc = decode_ext_sec_blob(ses, pSMBr);
} else if (server->sec_mode & SECMODE_PW_ENCRYPT) {
--
1.8.5.6
